Admidio EUVD-2026-103306

Requires a valid authenticated session on the target Admidio instance - any account tier is sufficient (PR:L), including ordinary members or self-registered users where open registration is enabled. The defining condition is that the flaw works specifically because the inventory_data.php DataTables JSON endpoint does not re-check the inventory_module_enabled setting, so exploitation succeeds even on deployments where administrators have explicitly disabled the inventory module. Limiting factors: the attacker must first obtain credentials (no unauthenticated path), impact is confined to reading inventory item data and keeper names (no write, no integrity or availability impact), and only Admidio versions 5.0.11 through 5.0.15 are affected (fixed in 5.0.16).

This is a genuine but moderate-priority information-disclosure issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a low-privilege authenticated account, with impact limited to confidentiality (VC:H; VI:N/VA:N). The CWE-862 (Missing Authorization) classification is consistent with the description: this is an authorization/broken-access-control flaw, not an unauthenticated authentication bypass. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.1 score is driven by ease of access (any valid login) rather than demonstrated in-the-wild abuse. The key limiting factor is PR:L: an attacker must already hold a valid account on the target Admidio instance, which contains rather than eliminates risk (self-registration, if enabled, would lower that bar). No conflicting signals exist between the CVSS vector and the description - both agree on authenticated, remote, confidentiality-only impact. Net: a real defect worth patching on a normal cadence, but not a drop-everything issue absent exploitation telemetry.

An attacker with any valid low-privilege Admidio account (e.g., an ordinary member, or a self-registered user where registration is open) sends a crafted HTTP request to the DataTables JSON endpoint in modules/inventory/inventory_data.php. Because the endpoint fails to enforce the inventory_module_enabled restriction, it returns the full inventory listing and keeper (person) names even on instances where administrators believe the module is disabled and hidden. No public exploit code was identified in the provided data.