CVE-2026-57152

Deferred Deferred - Pending Action

Permission Bypass in GLPI Document Access

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-57152

Affected Vendors & Products

Vendor	Product	Version / Range
glpi-project	glpi	>= 0.85, < 10.0.26
glpi-project	glpi	>= 11.0.0, < 11.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows a user to access documents linked to items without proper permission checks. It affects versions from 0.85 to 10.0.26 and 11.0.0 to 11.0.8. The issue could expose files to unauthorized users who should not have access.

Impact Analysis

Unauthorized users may view sensitive documents, leading to data leaks or compliance violations. Attackers could exploit this to access confidential information, affecting confidentiality and integrity of stored data.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive data to unauthorized individuals. Compliance may be compromised due to unauthorized access to personal or health information.

Mitigation Strategies

Upgrade GLPI to version 10.0.26 or 11.0.8 or later to address the permission logic flaw that allows unauthorized document access.

Hi! I’m here to help you understand CVE-2026-57152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...