GLPI permission check gap can expose documents
In an IT asset management program, users without permission can view documents.
Summary
GLPI is IT asset management software. Under certain conditions, its permission logic does not confirm that a document is linked to the targeted item, so users who should not see a file can be shown it.
What to do
Update to 10.0.26 or 11.0.8 or later.
Update to at least the version for your product:
- GLPI 10.x 10.0.26 or later
- GLPI 11.x 11.0.8 or later
Products and platforms
CVE IDs
Times
First published
First seen