CVE-2026-111914: Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.16
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Admidio user with a valid login can exploit it. No elevated privileges or user interaction are required.
What information can be exposed?
An attacker can request the DataTables JSON feed and read all inventory items and keeper names. The exposure is limited to confidentiality; the provided data does not indicate integrity or availability impact.
Are deployments affected when the inventory module is disabled?
Yes. The vulnerable endpoint bypasses the inventory_module_enabled restriction, so disabling the module does not prevent authenticated users from accessing the inventory data feed.
Which versions need attention?
Admidio versions from 5.0.11 before 5.0.16 are affected. Version 5.0.16 is not included in the affected range described.