Access Control Issue in GLPI Asset Management Software
CVE-2026-53626

7.1HIGH

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
25 September 2026

What is CVE-2026-53626?

GLPI, a popular free asset and IT management software, contains an access control vulnerability that can permit unauthorized users to view documents linked to restricted items. This occurs due to flawed permission logic present in versions 11.0.5 to 11.0.8. Under specific conditions, an authenticated user might exploit this flaw using an unrelated item they can access, thereby gaining unauthorized access to sensitive documents. The issue has been remediated in version 11.0.8.

Affected Version(s)

glpi >= 11.0.5, < 11.0.8

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/e984bf1ba435c...
x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/11.0.8
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.