CVE-2026-111914
Received Received - Intake

Authenticated Inventory Data Exposure in Admidio

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111914
EUVD
EUVD-2026-103306

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Admidio admidio 5.0.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in Admidio versions 5.0.11 through 5.0.16. The issue is in the inventory_data.php file which fails to enforce the inventory_module_enabled restriction. Authenticated users can bypass access controls to read all inventory items and keeper names via the DataTables JSON feed, even when the module is disabled.

Detection Guidance

Check if the inventory_data.php endpoint is accessible by logged-in users. Use a browser or curl to send a GET request to the endpoint (e.g., /admidio/modules/inventory/inventory_data.php) after authenticating. If it returns inventory data despite the module being disabled, the system is vulnerable.

Impact Analysis

Unauthorized users with valid logins can access sensitive inventory data including item names, categories, keeper details, borrow status, and custom fields. This exposes confidential information even when organizations have set restrictive visibility levels.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive inventory data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related information. The flaw allows exposure of keeper names, item details, and borrow status, potentially violating these regulations.

Mitigation Strategies

Update Admidio to version 5.0.16 or later. If immediate update is not possible, restrict access to the inventory_data.php file via server configuration (e.g., .htaccess or web server rules) to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111914. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart