Vulnerability in GLPI IT Management Software Allows Restricted Access to Knowledge Base Items
CVE-2026-53631

5.3MEDIUM

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
4 November 2026

What is CVE-2026-53631?

GLPI, a popular free asset and IT management software, contains an access control vulnerability that allows any authenticated user to submit a specially crafted request. This request can alter the visibility settings of knowledge base items, reminders, or RSS feeds, permitting access to content that should otherwise remain restricted. This issue affects versions from 0.83 to 10.0.27 and from 11.0.0 to 11.0.9. This vulnerability has been addressed in subsequent releases, including versions 10.0.27 and 11.0.9.

Affected Version(s)

glpi >= 0.83, < 10.0.27 < 0.83, 10.0.27

glpi >= 11.0.0, < 11.0.9 < 11.0.0, 11.0.9

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/6482e735e2a98...
x_refsource_MISC
https://github.com/glpi-project/glpi/commit/89ed992a44be2...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.