Admidio versions prior to 5.0.17 contain an improper access control flaw that allows authenticated members to register guests for an event even when the event is configured to disallow guests. By setting the additional_guests field with the remaining seat count in the events_module, an attacker can consume all available seats, effectively blocking other legitimate members from registering. This impact manifests as a denial of service to the event registration process rather than direct data breach or code execution.

The vulnerability affects all instances of Admidio running a version earlier than 5.0.17, most notably the 5.0.16 release and any earlier builds. The flaw is located in the events_function.php file within the modules/events directory and specifically targets the logic that validates guest registration permissions.

The CVSS score of 5.3 indicates moderate severity, and while there is no EPSS data available, the lack of this data does not imply low exploitability. The attack can be performed by any authenticated user without elevated privileges; the attacker can send a crafted HTTP request to the events module with an arbitrary additional_guests value. Because the vulnerability is not tied to remote code execution or elevated privilege escalation, the primary risk is service disruption for event registration, and the vulnerability is not listed in the CISA KEV catalog.