# CVE-2026-111914: Admidio broken access control in inventory module

Source: https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111914 · Severity: medium · CVSS 6.5 · Published 2026-10-17

Admidio is a web-based group management system used by organizations to manage members and resources. A flaw in versions 5.0.11 through 5.0.15 allows any logged-in user to read the complete inventory dataset—including item names, keeper names, and borrowing status—even when the inventory module is restricted to administrators or specific roles only. An attacker with any valid account can directly query the inventory API endpoint to bypass intended access controls.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio).

## Quick answers

**Is CVE-2026-111914 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111914 being exploited in the wild.

**How severe is CVE-2026-111914?** Medium severity, with a CVSS score of 6.5, published 17 October 2026.

**Which products and versions are affected?** Admidio 5.0.11 through 5.0.15.

**Is there a fix for CVE-2026-111914?** Yes: fixed in 5.0.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111914 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111914?** Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.16

## Technical details

The vulnerability is a broken access control (CWE-285) in modules/inventory/inventory_data.php, which serves as a DataTables JSON backend. While the main inventory module enforces inventory_module_enabled restrictions at the UI level (settings 0–5 for disabled through role-based access), the data endpoint only checks login_valid.php and never validates these module-level gates before returning rows. The WHERE clause scopes results only by organization and status, not by user permissions, allowing any authenticated attacker to directly request the endpoint and retrieve all inventory records with full details.

## Affected products

- Admidio Admidio 5.0.11 through 5.0.15

## Timeline

- 2026-10-02: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf](https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf)
- [https://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g](https://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)
- [Admidio broken access control in role member assignment](https://junglewise.ai/threats/cve-2026-109329-admidio-4-3-2-through-4-3-17-and-5-0-0-before-5-0-15-contains-a)