CVE-2026-111914 — Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_…
Published: 2026-10-17 · CVSS: 7.1 · CVSS 4.0
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7