{"id":"CVE-2026-111914","kind":"vulnerability","aliases":["CVE-2026-111914"],"related":[],"title":"Admidio: broken access control exposes inventory data when module disabled","description":"Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.","summary":"Admidio versions 5.0.11 through before 5.0.16 let any logged-in user request the inventory DataTables JSON feed and read every inventory item and keeper name. The check that should block access when the inventory module is disabled is bypassed.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admidio","package","php","self-hosted"],"not_affected_if":["already-patched","no-untrusted-accounts"],"how_to_check":"- Check the installed Admidio version (`modules/inventory` lives in the Admidio install directory); versions from `5.0.11` up to but not including `5.0.16` are affected\n- Confirm whether the inventory module is disabled in Admidio settings while accounts with ordinary logins still exist","fix":"- Upgrade Admidio to `5.0.16` or later","status":"open","published_at":"2026-10-17T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:15+00:00","updated_at":"2026-10-25T03:36:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Admidio to `5.0.16` or later","reach":"network","title":"Admidio: broken access control exposes inventory data when module disabled","impact":"medium","summary":"Admidio versions 5.0.11 through before 5.0.16 let any logged-in user request the inventory DataTables JSON feed and read every inventory item and keeper name. The check that should block access when the inventory module is disabled is bypassed.","category":"package","nicknames":[],"who_cares":["admidio","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"any logged-in user reads all inventory items and keeper names","analyst_note":"","how_to_check":"- Check the installed Admidio version (`modules/inventory` lives in the Admidio install directory); versions from `5.0.11` up to but not including `5.0.16` are affected\n- Confirm whether the inventory module is disabled in Admidio settings while accounts with ordinary logins still exist","needs_analyst":false,"not_affected_if":["already-patched","no-untrusted-accounts"],"who_is_affected":"Admidio installations running 5.0.11 up to but not including 5.0.16 are exposed, and the flaw only matters if the inventory module is turned off but registered members can still log in. Sites that are already on 5.0.16 or later, or that have no user accounts beyond trusted administrators, have less to worry about. The sources do not say whether exposure depends on any other setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000601,"input_tokens":3329,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111914':13A,16A '-2026':12A,15A '5.0.11':25B,65C '5.0.16':28B,67C 'access':3A,54B,71C 'admidio':1A,17B,23B,63C 'allow':77C 'attack':87C 'authent':78C 'block':53B 'broken':2A,70C 'bypass':62B,81C 'check':50B 'contain':68C 'control':4A,72C 'cve':11A,14A 'data':7A 'datat':38B,95C 'disabl':10A,60B,111C 'enabl':85C 'even':106C 'everi':43B,100C 'expos':5A 'feed':40B,97C 'host':22B 'inventori':6A,37B,44B,57B,83C,101C 'item':45B,102C 'json':39B,96C 'keeper':47B,104C 'let':29B 'log':32B 'logged-in':31B 'login':91C 'modul':9A,58B,84C,109C 'modules/inventory/inventory_data.php':75C 'name':48B,105C 'packag':18B 'php':19B 'read':42B,99C 'request':35B,93C 'restrict':86C 'self':21B 'self-host':20B 'user':34B,79C 'valid':90C 'version':24B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Admidio installations running 5.0.11 up to but not including 5.0.16 are exposed, and the flaw only matters if the inventory module is turned off but registered members can still log in. Sites that are already on 5.0.16 or later, or that have no user accounts beyond trusted administrators, have less to worry about. The sources do not say whether exposure depends on any other setting.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111914","severity":null,"published_at":"2026-10-17T19:16:33+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}