CVE-2026-57152 in Glpi
Summary
by MITRE • 11/05/2026
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
GLPI, widely recognized as an open-source IT asset management solution, facilitates the tracking of hardware, software, and network infrastructure across enterprise environments. The vulnerability identified within GLPI versions ranging from 0.85 through 10.0.26 and 11.0.0 through 11.0.8 represents a critical failure in access control logic specifically related to document management subsystems. In typical IT service management workflows, documents such as technical manuals, license agreements, or configuration files are attached to specific assets like servers, routers, or workstations. Access to these attachments is generally governed by the permissions associated with the parent asset and the user role of the requester. However, in this flawed implementation, the permission verification process contains a logical gap that allows users to retrieve document content without establishing a valid linkage between the requesting user’s authorized scope and the specific item to which the document belongs.
The technical root cause lies in how the application validates authorization when serving file downloads or viewing requests. Instead of strictly enforcing that the authenticated session possesses explicit rights over the target asset, the system appears to rely on incomplete checks regarding the attachment's metadata or direct identifier access. This oversight enables an attacker who has valid authentication credentials within the GLPI instance to enumerate and potentially download documents associated with assets they do not own or manage. By manipulating request parameters or exploiting the lack of cross-reference validation between user permissions and asset ownership, a malicious insider could bypass intended restrictions. This behavior aligns closely with CWE-284 Improper Access Control, where insufficient verification leads to unauthorized data exposure. Furthermore, this flaw facilitates information disclosure by allowing sensitive operational details stored within GLPI documents to be accessed beyond their designated audience boundaries.
The operational impact of this vulnerability is significant for organizations relying on GLPI for centralized IT documentation and asset tracking. Sensitive files such as network topology diagrams, software license keys, security configurations, or proprietary technical specifications could be exfiltrated by any authenticated user with basic access privileges. This exposure compromises the confidentiality integrity required for effective IT governance and may violate regulatory compliance standards that mandate strict data segregation based on role-based access controls. Attackers can leverage this information to map out network infrastructure, identify software vulnerabilities through version numbers found in documentation, or gather intelligence for further social engineering attacks against privileged administrators. The risk is particularly acute in multi-tenant environments or large enterprises where users have varying levels of visibility into different departments' assets but should not be able to access the detailed documentation attached to those assets.
Mitigation strategies primarily involve upgrading GLPI to patched versions, specifically 10.0.26 for the legacy branch and 11.0.8 for the current release line, which corrects the permission logic to ensure documents are only served when a valid association with an authorized item is confirmed. Until patching can be implemented, administrators should review user roles and permissions to minimize the number of users with access to sensitive document repositories. Implementing network-level controls such as web application firewalls may also help detect anomalous download patterns indicative of enumeration attacks. Additionally, organizations should audit existing GLPI deployments for any potential data leakage that occurred during the window when vulnerable versions were in production. Regular security assessments and adherence to industry standards like MITRE ATT&CK technique T1005 Data from Local System can aid in monitoring for unauthorized access attempts against document storage endpoints within the application ecosystem.