Executive Summary

CVE-2026-30927 is a security vulnerability in the Admidio event participation module that allows any user who can participate in an event to register or cancel participation for other users by manipulating the user_uuid GET parameter.

The issue arises because the code uses a logical OR condition that permits any participant, not just event leaders, to specify a different user_uuid and perform actions on behalf of that user. This means non-leader users can register or cancel event participation for other users without authorization.

The vulnerability was fixed in version 5.0.6 by enforcing that non-leader users can only manage their own participation, ignoring any manipulated user_uuid parameter.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'This vulnerability can lead to unauthorized registration or cancellation of event participation for other users.'}, {'type': 'list_item', 'content': 'Registering unwilling users for events, potentially causing harassment or spam.'}, {'type': 'list_item', 'content': "Canceling other users' event participation without their consent."}, {'type': 'list_item', 'content': 'Manipulating event participant counts and comments.'}, {'type': 'list_item', 'content': 'Abusing participation limits by filling event slots with unwanted registrations.'}, {'type': 'paragraph', 'content': 'Overall, it compromises the integrity of event management and user data security.'}] [2, 3]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves manipulation of the user_uuid GET parameter in the Admidio event participation module to register or cancel participation for other users without proper authorization.'}, {'type': 'paragraph', 'content': "To detect exploitation attempts on your system or network, you can monitor HTTP requests targeting the event participation functionality, specifically looking for requests that include the user_uuid parameter with values different from the authenticated user's UUID."}, {'type': 'paragraph', 'content': 'For example, you can use web server access logs or network traffic captures to identify suspicious GET requests to the event participation endpoint containing the user_uuid parameter.'}, {'type': 'list_item', 'content': 'Use grep or similar tools on web server logs to find requests with the user_uuid parameter: grep "user_uuid=" /path/to/access.log'}, {'type': 'list_item', 'content': "Use network monitoring tools like tcpdump or Wireshark to filter HTTP GET requests containing user_uuid: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'user_uuid='"}, {'type': 'list_item', 'content': "Check application logs or enable debugging in Admidio to log event participation requests and verify if user_uuid values differ from the current user's UUID."}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade Admidio to version 5.0.6 or later, where this vulnerability has been fixed.'}, {'type': 'paragraph', 'content': "The fix enforces that non-leader users cannot specify arbitrary user_uuid values by forcibly setting the user_uuid parameter to the current user's UUID unless the user is an event leader."}, {'type': 'paragraph', 'content': 'If immediate upgrade is not possible, consider restricting access to the event participation functionality to trusted users only, or implement additional access controls to prevent manipulation of the user_uuid parameter.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious activity involving user_uuid parameter manipulation and respond accordingly.'}] [1, 2]

Useful 0 Not Useful 0