CVE-2026-111914
High · CVSS 7.1Published 2026-10-17
CVSS
7.1
High
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-111914?
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
CVSS Score Explained
CVSS 7.1 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf
- ›https://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g
- ›https://www.vulncheck.com/advisories/admidio-5.0.11-before-5.0.16-broken-access-control-via-inventory-data-php
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—