CVE-2026-30927

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30927
Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user. This vulnerability is fixed in 5.0.6.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e Patch
https://github.com/Admidio/admidio/issues/1985 Issue Tracking
https://github.com/Admidio/admidio/security/advisories/GHSA-7pfv-hr63-h7cw Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*
History

13 Mar 2026, 14:45

Type Values Removed Values Added
Summary
  • (es) Admidio es una solución de gestión de usuarios de código abierto. Antes de la 5.0.6, en modules/events/events_function.php, la lógica de participación en eventos permite a cualquier usuario que pueda participar en un evento registrar a OTROS usuarios manipulando el parámetro GET user_uuid. La condición utiliza || (OR), lo que significa que si possibleToParticipate() devuelve verdadero (el evento está abierto para la participación), CUALQUIER usuario - no solo los líderes - puede especificar un user_uuid diferente y registrar/cancelar la participación para ese usuario. El código entonces opera sobre $user->getValue('usr_id') (el usuario objetivo de user_uuid) en lugar del usuario actual. Esta vulnerabilidad está corregida en la 5.0.6.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Admidio
Admidio admidio
References () https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e - () https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e - Patch
References () https://github.com/Admidio/admidio/issues/1985 - () https://github.com/Admidio/admidio/issues/1985 - Issue Tracking
References () https://github.com/Admidio/admidio/security/advisories/GHSA-7pfv-hr63-h7cw - () https://github.com/Admidio/admidio/security/advisories/GHSA-7pfv-hr63-h7cw - Mitigation, Vendor Advisory
CPE cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

10 Mar 2026, 17:40

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 17:40

Updated : 2026-03-13 14:45

NVD link : CVE-2026-30927

Mitre link : CVE-2026-30927

CVE.ORG link : CVE-2026-30927

JSON object : View

Products Affected

admidio

  • admidio
CWE
CWE-639

Authorization Bypass Through User-Controlled Key