CVE-2026-30927

Vulnerability

In modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter.

Line 47: $getUserUuid = admFuncVariableIsValid($_GET, 'user_uuid', 'uuid', ...)
Line 424: if ($event->possibleToParticipate() || $participants->isLeader($gCurrentUserId))

The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user.

The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user.

• Register unwilling users for events (potential harassment/spam)
• Cancel other users' event participation
• Manipulate event participant counts and comments
• If events have participation limits, fill slots with unwanted registrations

Kodem intelligence

For non-leader users, force user_uuid to the current user:

if (!$participants->isLeader($gCurrentUserId)) {
    $getUserUuid = $gCurrentUser->getValue('usr_uuid');
}

1. What is CVE-2026-30927? CVE-2026-30927 is a medium-severity security vulnerability in admidio/admidio (composer), affecting versions < 5.0.6. It is fixed in 5.0.6.
2. Which versions of admidio/admidio are affected by CVE-2026-30927? admidio/admidio (composer) versions < 5.0.6 is affected.
3. Is there a fix for CVE-2026-30927? Yes. CVE-2026-30927 is fixed in 5.0.6. Upgrade to this version or later.
4. Is CVE-2026-30927 exploitable, and should I be worried? Whether CVE-2026-30927 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-30927 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-30927? Upgrade admidio/admidio to 5.0.6 or later.