CVE-2026-30927: Admidio Auth Bypass Vulnerability

CVE-2026-30927 Overview

CVE-2026-30927 is an Authorization Bypass vulnerability discovered in Admidio, an open-source user management solution. The vulnerability exists in the event participation logic within modules/events/events_function.php, where improper access control allows any authenticated user who can participate in an event to register or cancel participation for OTHER users by manipulating the user_uuid GET parameter.

The flawed condition uses a logical OR (||) operator, meaning if possibleToParticipate() returns true (indicating the event is open for participation), ANY user—not just designated leaders—can specify a different user_uuid and modify participation status for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than validating the current user's authority to perform such actions.

Critical Impact

Authenticated users can manipulate event registrations for other users, potentially disrupting organizational events, causing data integrity issues, and enabling social engineering attacks within organizations using Admidio.

Affected Products

• Admidio versions prior to 5.0.6

Discovery Timeline

• 2026-03-10 - CVE-2026-30927 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30927

Vulnerability Analysis

This vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key), a category of Broken Access Control flaws. The core issue stems from the application accepting a user-controlled parameter (user_uuid) without properly validating whether the requesting user has authorization to perform actions on behalf of the target user.

In Admidio's event participation workflow, the system should enforce that only event leaders can register or manage participation for other users. However, the flawed conditional logic allows any participant to bypass this restriction simply by providing a different user's UUID in the request.

The impact includes unauthorized modification of event attendance records, potential denial of service by removing legitimate participants from events, and manipulation of organizational attendance tracking systems.

Root Cause

The root cause is improper authorization logic in modules/events/events_function.php. The conditional check uses an OR operator that evaluates possibleToParticipate() independently from leader status verification. When the event allows participation, this effectively grants all participants the same capability as leaders—namely, the ability to manage registrations for arbitrary users identified by the user_uuid parameter.

Attack Vector

An attacker with a valid authenticated session can exploit this vulnerability through the network by crafting a malicious HTTP request. The attack requires:

1. Valid authentication to the Admidio system
2. Access to an event open for participation
3. Knowledge of another user's UUID (which may be discoverable through enumeration or other application features)

The attacker simply modifies the user_uuid GET parameter in the event participation request to target a different user, allowing them to register or cancel that user's participation without authorization.

             $formValues['additional_guests'] = '';
         }
 
+        // if user is no leader of the event then only allow to handle their own participation
+        if (!$participants->isLeader($gCurrentUserId)) {
+            $getUserUuid = $gCurrentUser->getValue('usr_uuid');
+        }
+
         if (isset($eventsParticipationEditForm)) {
             $formValues = $eventsParticipationEditForm->validate($_POST);
         }

Source: GitHub Commit e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e

The patch adds an explicit check: if the current user is not a leader of the event, the system forces $getUserUuid to the current user's own UUID, preventing manipulation of other users' participation.

Detection Methods for CVE-2026-30927

Indicators of Compromise

• Web server logs showing requests to modules/events/events_function.php with user_uuid parameters that differ from the authenticated user's UUID
• Unexpected changes to event participation records without corresponding user activity
• Audit logs indicating event registration changes initiated by users other than the affected participant or event leaders

Detection Strategies

• Monitor HTTP requests for user_uuid parameter manipulation in event-related endpoints
• Implement log analysis rules to detect when the requesting user's session UUID differs from the user_uuid parameter value
• Review event participation audit trails for anomalies where non-leaders modified other users' participation status

Monitoring Recommendations

• Enable detailed access logging for the modules/events/ directory
• Configure web application firewall (WAF) rules to flag requests where user_uuid parameters appear to be user-controlled and differ from session identity
• Implement integrity monitoring for event participation database tables to detect unauthorized modifications

How to Mitigate CVE-2026-30927

Immediate Actions Required

• Upgrade Admidio to version 5.0.6 or later immediately
• Review event participation logs for signs of past exploitation
• Consider temporarily restricting event participation features if immediate patching is not possible
• Audit user accounts for unauthorized participation changes

Patch Information

The vulnerability is fixed in Admidio version 5.0.6. The patch, available via commit e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e, ensures that non-leader users can only manage their own event participation by forcing the user_uuid to the current user's UUID when leader privileges are not present.

For detailed patch information, see the GitHub Security Advisory GHSA-7pfv-hr63-h7cw and the related issue discussion.

Workarounds

• Restrict access to event participation features to trusted users only until patching can be completed
• Implement network-level access controls to limit access to Admidio administrative functions
• Deploy a web application firewall (WAF) rule to strip or validate user_uuid parameters against authenticated session identities
• Enable enhanced logging to detect and respond to exploitation attempts

# Example: Verify Admidio version after patching
grep -r "version" /path/to/admidio/adm_program/installation.xml | head -5

# Review web server logs for potential exploitation attempts
grep "events_function.php.*user_uuid" /var/log/apache2/access.log | grep -v "$(cat /path/to/known_admin_uuids.txt)"