CVE-2026-111914

Name of the Vulnerable Software and Affected Versions Admidio versions 5.0.11 through 5.0.15

Description Broken access control in the 'modules/inventory/inventory data.php' endpoint allows authenticated users to bypass the inventory module enabled restriction. An attacker with valid credentials can request the DataTables JSON feed to retrieve all inventory items and keeper names, regardless of whether the module is disabled.

Recommendations Update Admidio to version 5.0.16. Restrict access to the 'modules/inventory/inventory data.php' file as a temporary mitigation.