All vulnerabilities
CVE-2026-53626GHSA-q9rc-v6vm-q5mm

GLPI: Arbitrary Document Read via Form Context Authorization Bypass

glpi-project glpi
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.0.8Fixed versionGitHub
Published25 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.

Text from CVE List

Affected versions 2

  • glpiaffected: >= 11.0.5, < 11.0.8CVE List
  • glpi, glpi>= 11.0.5GitHub

References 3