CVE-2026-111914 Admidio CVE debrief

Who should care

Defenders and administrators of Admidio installations, particularly those using versions between 5.0.11 and 5.0.16, should assess exposure and apply necessary patches or mitigations.

Why it matters

CVE-2026-111914 is a high-severity vulnerability in Admidio that allows authenticated users to bypass access controls and read sensitive data. Defenders should prioritize verifying exposure, applying patches, and monitoring for unauthorized access due to the potential for data exposure and elevated privileges.

• Potential unauthorized data exposure through inventory items and keeper names.
• Bypass of access controls leading to elevated data access for authenticated users.
• Need for verification of Admidio version and exposure to the vulnerability.
• Priority on applying patches or updates to prevent exploitation.

Technical summary

The vulnerability exists in the modules/inventory/inventory_data.php file of Admidio, allowing authenticated users to bypass the inventory_module_enabled restriction and access DataTables JSON feeds. This could lead to unauthorized reading of inventory items and keeper names. The vulnerability has a high CVSS score of 7.1, indicating a high severity. Defenders should prioritize verifying exposure and applying patches due to the potential for data exposure. The affected product versions are Admidio from 5.0.11 before 5.0.16.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to the high CVSS score of 7.1 and the potential for data exposure.

Recommended defensive actions

• Verify Admidio version and check if it falls within the vulnerable range (5.0.11 to before 5.0.16).
• Assess exposure of the inventory module and potential data at risk.
• Apply patches or updates to Admidio to version 5.0.16 or later.
• Monitor for unauthorized access to inventory items and keeper names.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE and NVD records, with additional details from source references. However, the corpus does not provide explicit information on exploitation or affected versions beyond the specified range.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.