CVE-2026-53631 in GLPI
Summary
by MITRE • 11/05/2026
GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. This issue is fixed in versions 10.0.27 and 11.0.9.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
GLPI serves as a comprehensive open-source solution for IT asset management, service desk operations, and project tracking, widely deployed within enterprise environments to centralize information technology resources. The software relies on strict role-based access controls to ensure that sensitive operational data remains visible only to authorized personnel. However, in versions ranging from 0.83 through 10.0.27 and from 11.0.0 through 11.0.9, a critical authorization flaw exists within the application logic governing visibility settings for specific content types. This vulnerability allows any authenticated user to manipulate internal state variables related to knowledge base articles, system reminders, or RSS feed configurations without possessing the necessary administrative privileges required for such modifications.
The technical root of this issue lies in an improper implementation of access control checks during the request processing phase. When a user submits a crafted HTTP request intended to alter the visibility parameters of these specific entities, the application fails to adequately verify whether the requesting actor holds sufficient permissions to perform the action. Instead of rejecting the unauthorized modification attempt based on role hierarchy or group membership, the system processes the change and updates the database records accordingly. This logic error effectively bypasses the intended security boundaries, allowing lower-privileged users to escalate their effective privileges by changing restricted items from private or internal visibility levels to public or broader access scopes.
The operational impact of this vulnerability is significant for organizations relying on GLPI for sensitive IT operations. Knowledge base articles often contain detailed troubleshooting procedures, architectural diagrams, and configuration details that may reveal infrastructure weaknesses if exposed publicly. Reminders can include scheduled maintenance windows, security patching schedules, or incident response protocols that are critical to maintaining system integrity but must remain confidential from external actors or unauthorized internal staff. RSS feeds aggregated within the platform might pull in sensitive alerts or logs that could aid an attacker in mapping network topology or identifying unpatched systems. By exploiting this flaw, a malicious insider or compromised account holder can exfiltrate high-value information without triggering typical privilege escalation alarms associated with direct database manipulation attempts.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Assignment, as the application grants capabilities to users that exceed their designated role permissions. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior facilitates lateral movement and information discovery phases of an attack chain. An adversary who gains initial access through weak credentials or phishing can leverage this flaw to expand their footprint within the IT management system, potentially leading to further exploitation of connected systems via exposed API endpoints or integrated services. The lack of proper authorization checks represents a fundamental failure in enforcing least privilege principles central to secure software design.
Mitigation strategies must prioritize immediate version upgrades for all affected deployments. Administrators should upgrade GLPI to versions 10.0.27 or later, and specifically 11.0.9 or newer for the latest release line, as these versions contain patches that enforce rigorous validation of user permissions before processing visibility changes. In environments where upgrading is not immediately feasible due to dependency constraints, temporary compensating controls should be implemented. These include restricting access to GLPI behind robust network segmentation and firewalls, ensuring only trusted IP ranges can reach the application interface. Additionally, enabling multi-factor authentication for all administrative accounts reduces the risk of initial compromise that could lead to exploitation of this authorization flaw. Regular auditing of user roles and permissions is also recommended to ensure no excessive privileges are assigned inadvertently, thereby reducing the attack surface available to potential exploiters seeking to manipulate visibility settings.