Broken Access Control in Admidio Affects Inventory Module Functionality
CVE-2026-111914

7.1HIGH

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111914?

The Admidio platform versions 5.0.11 through 5.0.15 have a significant flaw in the inventory module due to broken access control in the inventory_data.php file. This vulnerability allows authenticated users to bypass the inventory_module_enabled restriction. As a result, any user with valid login credentials can exploit this issue to access the DataTables JSON feed, exposing sensitive data including all inventory items and keeper names, even when the inventory module is supposed to be disabled.

Affected Version(s)

admidio 5.0.11 < 5.0.16

admidio 5.0.16

References

https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory
https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/admidio-5.0.11-befor...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
.