CVE-2026-53626: GLPI: Arbitrary Document Read via Form Context Authorization Bypass
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 11.0.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can view an unrelated GLPI item may be able to read a document attached to an item they are not allowed to access. Exploitation depends on the affected permission logic granting document access without verifying the document’s association with the targeted item.
Which versions are affected and what version fixes it?
The issue affects GLPI versions from 11.0.5 until 11.0.8. It is fixed in GLPI 11.0.8.
What access is required for an attacker to read an inaccessible document?
The attacker needs permission to view an unrelated item. They can use that permitted item as the context for a request to access a document linked to an inaccessible item.