Quick answers
- Is CVE-2026-111914 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111914 being exploited in the wild.
- How severe is CVE-2026-111914?
- Medium severity, with a CVSS score of 6.5, published 17 October 2026.
- Which products and versions are affected?
- Admidio 5.0.11 through 5.0.15.
- Is there a fix for CVE-2026-111914?
- Yes: fixed in 5.0.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-111914 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-111914?
- Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 5.0.16
Technical details
The vulnerability is a broken access control (CWE-285) in modules/inventory/inventory_data.php, which serves as a DataTables JSON backend. While the main inventory module enforces inventory_module_enabled restrictions at the UI level (settings 0–5 for disabled through role-based access), the data endpoint only checks login_valid.php and never validates these module-level gates before returning rows. The WHERE clause scopes results only by organization and status, not by user permissions, allowing any authenticated attacker to directly request the endpoint and retrieve all inventory records with full details.
Affected products
- Admidio Admidio 5.0.11 through 5.0.15
Timeline
- 2026-10-02: disclosed
- 2026-10-17: advisory