CVE-2026-111914— Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
Quick assessment
Affected
Admidio admidio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Admidio 5.0.11 至 5.0.16（不含 5.0.16）版本中， 文件存在访问控制缺陷，允许已认证用户绕过 限制。任何拥有有效登录凭证的攻击者均可请求 DataTables 的 JSON 数据源，从而读取所有库存项目及其保管人姓名，即使该库存模块已被禁用。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111914
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
Source: CVE Program / CVE List V5
Vulnerability Description
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111914
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111914
请登录查看更多情报信息。
Other References for CVE-2026-111914 (3)
Same Patch Batch · Admidio · 2026-10-17 · 4 CVEs total
| CVE-2026-111912 | 6.5 MEDIUM | Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update |
| CVE-2026-111916 | 5.3 MEDIUM | Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed |
| CVE-2026-111913 | 4.3 MEDIUM | Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php |
IV. Related Vulnerabilities
Same product: admidio
-
CVE-2026-111916
Admidio before 5.0.16 Information Disclosure via rss/links.p -
CVE-2026-111912
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update -
CVE-2026-111913
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mo -
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-O -
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via R
Same vendor: Admidio
-
CVE-2026-111916
Admidio before 5.0.16 Information Disclosure via rss/links.p -
CVE-2026-111913
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mo -
CVE-2026-111912
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update -
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-O -
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via R
Same weakness: CWE-862
-
CVE-2026-110882
WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Br -
CVE-2026-111916
Admidio before 5.0.16 Information Disclosure via rss/links.p -
CVE-2026-111910
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Auth -
CVE-2026-111897
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass -
CVE-2026-111889
phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-bet
V. Comments for CVE-2026-111914
No comments yet