All vulnerabilities
CVE-2026-111914GHSA-5f29-r7rj-43mfGHSA-qfjf-c48f-x87g

Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php

Admidio admidio
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.16Fixed versionCVE List
Published17 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 5.0.16admidioCVE List
  • 5.0.16admidio/admidio, composerGitHubcomposer require "admidio/admidio:^5.0.16"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.

Text from CVE List

Affected versions 4

  • admidioaffected: 5.0.11 before 5.0.16CVE List
  • admidiounaffected: 5.0.16CVE List
  • admidio/admidio, composer>= 5.0.11, <= 5.0.15GitHub
  • admidio/admidio, other>= 5.0.11, <= 5.0.14GitHub

References 3