{"id":"CVE-2026-57152","kind":"vulnerability","aliases":["CVE-2026-57152"],"related":[],"title":"GLPI: document permission check lets users view unlinked files","description":"GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.","summary":"GLPI, a free asset and IT management application, could grant a user access to a document without checking that the document was linked to the item being requested. An attacker with a normal account could read files they should not be able to see.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["glpi","package","php","self-hosted"],"not_affected_if":["no-user-accounts","patched-version"],"how_to_check":"- Check the installed GLPI version in the admin footer or `inc/define.php`; affected releases are from `0.85` up to but not including `10.0.26`, and from `11.0.0` up to but not including `11.0.8`.\n- Confirm whether users outside your IT staff have GLPI accounts that can reach document attachments.","fix":"- GLPI `10.0.26`\n- GLPI `11.0.8`","status":"open","published_at":"2026-11-04T23:17:52+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:55+00:00","updated_at":"2026-11-05T00:31:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T00:31:55Z","model":"claude-haiku-5-5","output":{"fix":"- GLPI `10.0.26`\n- GLPI `11.0.8`","reach":"network","title":"GLPI: document permission check lets users view unlinked files","impact":"medium","summary":"GLPI, a free asset and IT management application, could grant a user access to a document without checking that the document was linked to the item being requested. An attacker with a normal account could read files they should not be able to see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glpi","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"A logged-in user reads documents belonging to items they cannot access","analyst_note":"","how_to_check":"- Check the installed GLPI version in the admin footer or `inc/define.php`; affected releases are from `0.85` up to but not including `10.0.26`, and from `11.0.0` up to but not including `11.0.8`.\n- Confirm whether users outside your IT staff have GLPI accounts that can reach document attachments.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-user-accounts"],"who_is_affected":"Any GLPI instance in the affected version ranges where users can log in and document attachments are used. The exposure depends on the permission logic under certain conditions, which the sources do not describe in detail. Instances already on `10.0.26` or `11.0.8` or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4302,"output_tokens":525,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57152':12A,15A '0.85':77C '10.0.26':79C,132C '11.0.0':82C '11.0.8':84C,134C 'abl':63B,122C 'access':34B,95C 'account':55B 'applic':29B 'asset':25B,70C 'attack':51B 'certain':86C 'check':4A,39B 'condit':87C 'confirm':100C 'could':30B,56B,91C,111C 'cve':10A,13A 'document':2A,37B,42B,98C,103C 'expos':112C 'file':9A,58B,114C 'fix':129C 'free':24B,69C 'glpi':1A,16B,22B,66C,88C 'grant':31B,92C 'host':21B 'issu':127C 'item':47B,109C 'let':5A 'link':44B,105C 'logic':90C 'manag':28B,73C 'normal':54B 'packag':17B,75C 'permiss':3A,89C 'php':18B 'read':57B 'request':49B 'see':65B 'self':20B 'self-host':19B 'softwar':74C 'target':108C 'unlink':8A 'user':6A,33B,94C,117C 'version':131C 'view':7A,124C 'without':38B,99C","nicknames":[],"mitigations":[],"who_affected":"Any GLPI instance in the affected version ranges where users can log in and document attachments are used. The exposure depends on the permission logic under certain conditions, which the sources do not describe in detail. Instances already on `10.0.26` or `11.0.8` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["glpi","high","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-27T07:54:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57152","severity":null,"published_at":"2026-11-04T23:17:52+00:00","modified_at":"2026-11-04T23:17:52+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71482,"url":"https://github.com/glpi-project/glpi/commit/8a71d5800c48023cb8c6cb25c6f7fd2e1bce945c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71483,"url":"https://github.com/glpi-project/glpi/commit/dcabe7c78f4da0f3498ebfe77c177b1b3be6d6c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71465,"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71466,"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71486,"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-7v5q-w6f3-2v8p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-27T07:54:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}