CVE-2026-57152 · Package
NO FIX YET · SEE WHAT TO DO
GLPI, a free asset and IT management application, could grant a user access to a document without checking that the document was linked to the item being requested. An attacker with a normal account could read files they should not be able to see.
first public Jul 27, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any GLPI instance in the affected version ranges where users can log in and document attachments are used. The exposure depends on the permission logic under certain conditions, which the sources do not describe in detail. Instances already on 10.0.26 or 11.0.8 or later are not affected.
Not affected if no-user-accounts, patched-version
Who cares glpi, php, self-hosted
inc/define.php; affected releases are from 0.85 up to but not including 10.0.26, and from 11.0.0 up to but not including 11.0.8.GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
10.0.2611.0.8This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.