Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Vulnerability
In modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter.
Line 47: $getUserUuid = admFuncVariableIsValid($_GET, 'user_uuid', 'uuid', ...)
Line 424: if ($event->possibleToParticipate() || $participants->isLeader($gCurrentUserId))
The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user.
The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user.
Impact
- Register unwilling users for events (potential harassment/spam)
- Cancel other users' event participation
- Manipulate event participant counts and comments
- If events have participation limits, fill slots with unwanted registrations
Fix
For non-leader users, force user_uuid to the current user:
if (!$participants->isLeader($gCurrentUserId)) {
$getUserUuid = $gCurrentUser->getValue('usr_uuid');
}Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | admidio/admidio | < 5.0.6 | 5.0.6 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N- Weakness (CWE)
CWE-639- Platform
- Composer
- Package
admidio/admidio- Disclosed
- 09.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7pfv-hr63-h7cw - CC BY 4.0
Vulnerability history: admidio/admidio
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 50
- First → latest
- 03.2022 07.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 10
- Medium 33
- Low 4
Disclosures per year
- 2022: 3
- 2023: 7
- 2024: 3
- 2025: 1
- 2026: 36
-
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.