GHSA-7v5q-w6f3-2v8p: GLPI: Unallowed notifications sending

Published Nov 4, 2026

Updated

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 10.0.26
Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8

Event History

Nov 4, 2026

CVE Published

via OSV·10:20 PM

Data Sourced

via OSV·10:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which GLPI deployments are affected?

The issue affects GLPI versions from 0.85 through 10.0.26 and versions from 11.0.0 through 11.0.8, under certain conditions. It is fixed in versions 10.0.26 and 11.0.8.

What access does an attacker need?

An attacker needs an existing GLPI user account with low privileges. No user interaction is required, and the vulnerability can be exploited over the network.

What information could be exposed?

A user may gain access to a document without validation that the document is linked to the item they are targeting. This can expose files to users who should not have permission to view them.

GHSA-7v5q-w6f3-2v8p: GLPI: Unallowed notifications sending

Remediation

Event History

Frequently Asked Questions

Which GLPI deployments are affected?

What access does an attacker need?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which GLPI deployments are affected?

What access does an attacker need?

What information could be exposed?