CVE-2026-57152: GLPI: Unallowed notifications sending
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 10.0.26 - Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 11.0.8
Event History
Frequently Asked Questions
Which GLPI deployments are affected?
GLPI versions from 0.85 through 10.0.26 and versions from 11.0.0 through 11.0.8 are affected under certain conditions. The issue is fixed in 10.0.26 and 11.0.8.
What access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges in GLPI. Exploitation does not require user interaction and can be performed over the network.
What is the impact of successful exploitation?
A user may gain access to a document without the system confirming that the document is linked to the targeted item. This can expose files to users who should not be permitted to view them.