CVE-2026-53626 in GLPI
Summary
by MITRE • 09/25/2026
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
GLPI, widely deployed as a free asset and IT management software package, facilitates the tracking of hardware, software, and network infrastructure within enterprise environments. The vulnerability identified between versions 11.0.5 and 11.0.8 represents a critical flaw in the application's access control logic regarding document retrieval mechanisms. This issue stems from an insufficient verification process when handling requests for documents associated with specific managed items such as computers, printers, or network devices. In a properly secured system, any attempt to retrieve a document must validate that the requesting user possesses explicit permissions not only for the action but also for the specific parent item to which the document is attached. However, in the affected versions, the permission check logic fails to enforce this linkage constraint under certain conditions.
The technical flaw allows an authenticated attacker with limited privileges to bypass intended access restrictions through a form of insecure direct object reference or broken access control mechanism. Specifically, if a user has read permissions for one item within GLPI, they can manipulate requests to retrieve documents that are actually linked to different items for which the user holds no such permissions. The application incorrectly assumes that valid session context and general view rights on any item are sufficient to authorize document downloads, ignoring the strict requirement that the target of the access must match the authorized scope. This logical error effectively decouples the security boundary of the parent object from its associated data artifacts, creating a significant gap in data isolation.
The operational impact of this vulnerability is substantial for organizations relying on GLPI for sensitive IT asset management. Documents stored within the system often contain confidential information such as license keys, configuration files, network diagrams, or proprietary technical specifications. By exploiting this flaw, an attacker with low-level access can escalate their effective privileges to view restricted data without needing higher administrative rights. This leads to a direct violation of confidentiality and potentially aids in further reconnaissance activities where detailed internal infrastructure details are exposed to unauthorized personnel. The severity is compounded by the fact that GLPI instances often serve as central repositories for critical IT operational knowledge, making any leakage of this information particularly damaging to organizational security posture.
This vulnerability aligns with CWE-284 Improper Access Control and falls under MITRE ATT&CK technique T1078 Valid Accounts, where an attacker leverages legitimate credentials but abuses the application's logic to access resources outside their intended scope. To mitigate this risk, organizations running GLPI versions 11.0.5 through 11.0.7 must immediately upgrade to version 11.0.8 or later, which includes patches for these permission checks. Additionally, administrators should review audit logs for any unusual document access patterns that might indicate exploitation of this flaw prior to the patching window. Implementing strict input validation and ensuring that all data retrieval endpoints verify both user permissions and object ownership relationships is essential for maintaining robust security controls in IT management platforms.