GHSA-7PFV-HR63-H7CW

Vulnerability from github – Published: 2026-03-09 19:45 – Updated: 2026-03-10 18:39
VLAI
Summary
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Details

Vulnerability

In modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter.

Line 47: $getUserUuid = admFuncVariableIsValid($_GET, 'user_uuid', 'uuid', ...) Line 424: if ($event->possibleToParticipate() || $participants->isLeader($gCurrentUserId))

The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user.

The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user.

Impact

  • Register unwilling users for events (potential harassment/spam)
  • Cancel other users' event participation
  • Manipulate event participant counts and comments
  • If events have participation limits, fill slots with unwanted registrations

Fix

For non-leader users, force user_uuid to the current user:

if (!$participants->isLeader($gCurrentUserId)) {
    $getUserUuid = $gCurrentUser->getValue('usr_uuid');
}
Severity
0.0 (None)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30927"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-09T19:45:20Z",
    "nvd_published_at": "2026-03-10T17:40:16Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability\n\nIn `modules/events/events_function.php`, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the `user_uuid` GET parameter.\n\nLine 47: `$getUserUuid = admFuncVariableIsValid($_GET, \u0027user_uuid\u0027, \u0027uuid\u0027, ...)`\nLine 424: `if ($event-\u003epossibleToParticipate() || $participants-\u003eisLeader($gCurrentUserId))`\n\nThe condition uses `||` (OR), meaning if `possibleToParticipate()` returns true (event is open for participation), ANY user - not just leaders - can specify a different `user_uuid` and register/cancel participation for that user.\n\nThe code then operates on `$user-\u003egetValue(\u0027usr_id\u0027)` (the target user from user_uuid) rather than the current user.\n\n## Impact\n- Register unwilling users for events (potential harassment/spam)\n- Cancel other users\u0027 event participation\n- Manipulate event participant counts and comments\n- If events have participation limits, fill slots with unwanted registrations\n\n## Fix\nFor non-leader users, force `user_uuid` to the current user:\n```php\nif (!$participants-\u003eisLeader($gCurrentUserId)) {\n    $getUserUuid = $gCurrentUser-\u003egetValue(\u0027usr_uuid\u0027);\n}\n```",
  "id": "GHSA-7pfv-hr63-h7cw",
  "modified": "2026-03-10T18:39:33Z",
  "published": "2026-03-09T19:45:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-7pfv-hr63-h7cw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30927"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/issues/1985"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.