Description
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Admidio | admidio | 5.0.11 – < 5.0.16 | 5.0.16 |
References
- GitHub Security Advisory (GHSA-5f29-r7rj-43mf) vendor-advisory
- GitHub Security Advisory (GHSA-qfjf-c48f-x87g) vendor-advisory
- VulnCheck Advisory: Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php third-party-advisory