CVE-2026-30927
Authorization Bypass in Admidio Events Module Allows User Impersonation
Publication date: 2026-03-10
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| admidio | admidio | to 5.0.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30927 is a security vulnerability in the Admidio event participation module that allows any user who can participate in an event to register or cancel participation for other users by manipulating the user_uuid GET parameter.
The issue arises because the code uses a logical OR condition that permits any participant, not just event leaders, to specify a different user_uuid and perform actions on behalf of that user. This means non-leader users can register or cancel event participation for other users without authorization.
The vulnerability was fixed in version 5.0.6 by enforcing that non-leader users can only manage their own participation, ignoring any manipulated user_uuid parameter.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can lead to unauthorized registration or cancellation of event participation for other users.'}, {'type': 'list_item', 'content': 'Registering unwilling users for events, potentially causing harassment or spam.'}, {'type': 'list_item', 'content': "Canceling other users' event participation without their consent."}, {'type': 'list_item', 'content': 'Manipulating event participant counts and comments.'}, {'type': 'list_item', 'content': 'Abusing participation limits by filling event slots with unwanted registrations.'}, {'type': 'paragraph', 'content': 'Overall, it compromises the integrity of event management and user data security.'}] [2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves manipulation of the user_uuid GET parameter in the Admidio event participation module to register or cancel participation for other users without proper authorization.'}, {'type': 'paragraph', 'content': "To detect exploitation attempts on your system or network, you can monitor HTTP requests targeting the event participation functionality, specifically looking for requests that include the user_uuid parameter with values different from the authenticated user's UUID."}, {'type': 'paragraph', 'content': 'For example, you can use web server access logs or network traffic captures to identify suspicious GET requests to the event participation endpoint containing the user_uuid parameter.'}, {'type': 'list_item', 'content': 'Use grep or similar tools on web server logs to find requests with the user_uuid parameter: grep "user_uuid=" /path/to/access.log'}, {'type': 'list_item', 'content': "Use network monitoring tools like tcpdump or Wireshark to filter HTTP GET requests containing user_uuid: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'user_uuid='"}, {'type': 'list_item', 'content': "Check application logs or enable debugging in Admidio to log event participation requests and verify if user_uuid values differ from the current user's UUID."}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade Admidio to version 5.0.6 or later, where this vulnerability has been fixed.'}, {'type': 'paragraph', 'content': "The fix enforces that non-leader users cannot specify arbitrary user_uuid values by forcibly setting the user_uuid parameter to the current user's UUID unless the user is an event leader."}, {'type': 'paragraph', 'content': 'If immediate upgrade is not possible, consider restricting access to the event participation functionality to trusted users only, or implement additional access controls to prevent manipulation of the user_uuid parameter.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious activity involving user_uuid parameter manipulation and respond accordingly.'}] [1, 2]