Read the docs
TI-2026-76121 Aliases CVE-2026-111914GHSA-pf3j-3gfx-w49c

Missing authorization in Admidio exposes inventory data when module is disabled

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Admidio from 5.0.11 before 5.0.16 has a missing authorization check in modules/inventory/inventory_data.php (CWE-862). An authenticated user with any valid login can read every inventory item and keeper name even when the inventory module is disabled. The source gives a proof-of-concept exploit status but no confirmed exploitation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Fix Fixed admidio (Admidio): 5.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admidioadmidio5.0.11 to before 5.0.165.0.16Patch availableCNA
  • admidio VendorAdmidio Affected 5.0.11 to before 5.0.16 Fixed in 5.0.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*——Admidio
  • cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Admidio 5.0.16 fixes the flaw, so upgrade from 5.0.11 before 5.0.16 to 5.0.16 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA admidio (Admidio) Fixed in 5.0.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    admidio 5.0.16

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76122 Missing authorization in Admidio weblinks RSS feed exposes restricted linksPriority HIGH 70
    • TI-2026-76120 Authorization bypass in Admidio list export via pdfl modePriority MEDIUM 57
    • TI-2026-76119 Admidio IDOR lets members edit other users' forum topicsPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111914
  2. 2026-10-18 Alias added: GHSA-pf3j-3gfx-w49c

References

Advisory 2

  • TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
  • TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
  • TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
  • TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
  • TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences