CVE-2026-111914 Details
Description
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
A broken access control vulnerability has been identified in Admidio versions 5.0.11 prior to 5.0.16. The issue resides in the 'modules/inventory/inventory_data.php' file, where the 'inventory_module_enabled' restriction is not properly enforced. This flaw allows authenticated users to access the DataTables JSON feed, revealing all inventory items and the names of their keepers, even when the module is disabled. The vulnerability arises because the DataTables backend only checks if a user is logged in, bypassing the necessary module-level access controls.
Users can update to Admidio version 5.0.16 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf | CISA-ADP | AdvisoryBundleExploitTechnical AnalysisVendor |
| https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf | [email protected] | AdvisoryBundleExploitTechnical AnalysisVendor |
| https://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/admidio-5.0.11-before-5.0.16-broken-access-control-via-inventory-data-php | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Admidio | >= 5.0.11, <= 5.0.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |