Live › vulnerability › CVE-2026-111914
Go to dashboardAdmidio versions 5.0.11 through before 5.0.16 let any logged-in user request the inventory DataTables JSON feed and read every inventory item and keeper name. The check that should block access when the inventory module is disabled is bypassed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Admidio installations running 5.0.11 up to but not including 5.0.16 are exposed, and the flaw only matters if the inventory module is turned off but registered members can still log in. Sites that are already on 5.0.16 or later, or that have no user accounts beyond trusted administrators, have less to worry about. The sources do not say whether exposure depends on any other setting.
No product ranges from the sources yet.
modules/inventory lives in the Admidio install directory); versions from 5.0.11 up to but not including 5.0.16 are affected5.0.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-111914")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.