CVE-2026-53631

Deferred Deferred - Pending Action

Information Disclosure in GLPI Software

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. This issue is fixed in versions 10.0.27 and 11.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-53631

Affected Vendors & Products

Vendor	Product	Version / Range
glpi-project	glpi	>= 0.83, < 10.0.27
glpi-project	glpi	>= 11.0.0, < 11.0.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows any authenticated user to submit a crafted request that changes the visibility of knowledge base items, reminders, or RSS feeds. This could expose restricted content to unauthorized users.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive information such as internal knowledge base articles, reminders, or RSS feed content that should be restricted to specific users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA, which mandate strict control over data access and protection.

Mitigation Strategies

Upgrade GLPI to version 10.0.27 or 11.0.9 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-53631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...