Admidio CVE-2026-117554

Requires an authenticated ordinary Member account that is eligible to participate in the target event (PR:L). The event must have a maximum-participants limit set and 'Participants can register anonymous guests' DISABLED - the precise policy the flaw bypasses; when guests are disabled the form still ships additional_guests as a hidden input that the handler trusts. The attacker also needs a valid session cookie and the per-request adm_csrf_token (both obtained normally by the logged-in member) and modifies only the additional_guests value in the POST to modules/events/events_function.php?mode=participate. Limiting factors: no anonymous/unauthenticated path (membership and event eligibility required), a valid CSRF token is needed, and impact is confined to blocking registration and skewing the participant count - there is no confidentiality breach or remote code execution.

This is a genuine but low-severity, authenticated business-logic flaw (CWE-602, client-side enforcement of server-side security) rather than a high-impact issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability and low complexity but requires privileges (PR:L) - i.e. a valid, event-eligible Member account - and the only impact is low integrity (VI:L) with no confidentiality (VC:N) and no system availability (VA:N) effect; the practical consequence is denial of event registration for other members plus corruption of the participant count, not code execution or data theft. No EPSS score is provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as a public proof-of-concept existing in the vendor GHSA advisory. The vuln.today decision label is this_month, consistent with a real-but-non-emergency defect that warrants scheduled patching rather than immediate incident response. One signal tension worth noting: the input Tags label this 'Information Disclosure', which conflicts with the CVSS confidentiality impact of VC:N/C:N - the core issue is access-control/capacity abuse, with only an incidental leak of the event's 'Max. participants' value observed in the PoC.

An ordinary authenticated Admidio member opens an event whose organizer disabled guest registration, intercepts the normal participation POST to events_function.php, and changes the hidden additional_guests field from 0 to the number of remaining seats. The server trusts the client-supplied value and counts those phantom guests against the event's maximum, filling capacity so no other member can register. A detailed, confirmed proof-of-concept with HTTP requests and screenshots is published in the GHSA advisory (GHSA-92g9-59rr-c3qg).