Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated… (CVE-2026-111914)

The vulnerability in Admidio affects versions starting from 5.0.11 before 5.0.16. It exists in the file modules/inventory/inventory_data.php and allows authenticated users with any valid login to bypass the inventory_module_enabled restriction. This broken access control vulnerability permits unauthorized reading of the entire inventory data including keeper names via the DataTables JSON feed, regardless of whether the inventory module is enabled or not.

An attacker with any valid user account can access sensitive inventory information that should be restricted when the inventory module is disabled. This leads to unauthorized disclosure of inventory items and keeper names. The CVSS score of 6.5 (High) reflects the network attack vector, low attack complexity, and no user interaction required, with high confidentiality impact but no integrity or availability impact.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user access to trusted users only and monitor for unauthorized access attempts to inventory data endpoints.