medium6.5
CVE-2026-111914
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to byp…
Impact
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Affected products
| Product | Affected versions |
|---|---|
| Admidio From 5.0.11 | before 5.0.16 |
Versions were read from the advisory text. No structured product data has been published for this record yet.