PT-2026-116484 · Admidio · Admidio
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Admidio