The vulnerability exists in the event participation module of Admidio; an OR condition allows any user who has permission to participate to manipulate the user_uuid parameter and register or cancel participation for another user. By setting a different user_uuid value, an attacker can cause a non‑leader to appear registered, or remove another user's registration, altering attendance records without permission.

Admidio installations running any version before 5.0.6 are affected. The flaw appears in modules/events/events_function.php and applies to all authenticated users who can participate in events, regardless of leadership status.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated web access and the ability to modify the user_uuid GET parameter. No elevated privileges beyond the standard event‑participation rights are necessary.