CVE-2026-33746: Improper Authentication

Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated...

CVE-2026-30927

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. The condition uses || OR, meaning if...

CVE-2026-30927: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. The condition uses || OR, meaning if...

CVE-2026-30927

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. The condition uses || OR, meaning if...

CVE-2026-30927

CVE-2026-30927 affects Admidio (open-source user management). Prior to 5.0.6, the event participation logic in modules/events/events_function.php allowed any user who can participate in an event to register or cancel participation for OTHER users by manipulating the user_uuid GET parameter. The c...

Authorization Bypass Through User-Controlled Key

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the useruuid parameter in the event participation process. An attacker can...