Fiche vulnérabilité
CVE-2026-30927 : faille moyenne admidio admidio (CVSS 5.4)
Description
Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user. This vulnerability is fixed in 5.0.6.
En bref
- Sévérité
- Moyenne (CVSS 5.4)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Exploitation active
- Non signalée par la CISA
- Publication
- 10 mars 2026
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- admidio admidio