5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30927

CVE-2026-30927: Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user. This vulnerability is fixed in 5.0.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30927

CVE-2026-30927:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	< 5.0.6	5.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the event participation module of Admidio. The analysis of the provided commit e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e confirms the description of the vulnerability. The patch is applied to the file modules/events/events_function.php. The change introduces a check to ensure that only event leaders can manage the participation of other users. For non-leader users, the user_uuid is forcibly set to their own, preventing them from registering or unregistering other users for an event. The vulnerable code is not within a specific function but in the main body of the PHP script events_function.php. Therefore, the script itself is identified as the vulnerable component. During runtime, when a user interacts with event participation, this script is executed, and the vulnerable logic would be triggered if a malicious user_uuid is provided.

Vulnerable functions

events_function.php

modules/events/events_function.php

The vulnerability exists in the main execution logic of the `events_function.php` script. The script retrieves the `user_uuid` from the GET parameters. Before the patch, it did not properly authorize if the current user was allowed to act on behalf of the user specified by `user_uuid`. This allowed any user who could participate in an event to register or unregister other users by manipulating the `user_uuid` parameter. The patch fixes this by checking if the current user is a leader of the event; if not, it forces the `user_uuid` to be that of the currently logged-in user, thus preventing them from modifying the participation of other users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.