Admidio versions 5.0.11 through 5.0.15 contain a broken access control in modules/inventory/inventory_data.php. Authenticated users can bypass the inventory_module_enabled restriction and request the DataTables JSON feed. This allows them to read every inventory item and keeper name even when the inventory module is disabled, exposing potentially sensitive information.

The affected product is Admidio, a web‑based collaboration platform, in all releases from version 5.0.11 up to (but excluding) 5.0.16. Users running any of these versions are vulnerable.

The vulnerability has a CVSS score of 7.1, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated session; once logged in, an attacker can issue a request to inventory_data.php and retrieve the full inventory dataset with no additional privileges. No public exploit code has been reported, but the flaw is logically simple and should be considered high risk in environments where inventory data must remain confidential.