GLPI CVE-2026-13490

Q: What is the CVSS score of CVE-2026-13490?

CVE-2026-13490 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39990 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-28 VulDB

GHSA-8cgc-j54m-4q3w

Authentication Bypass PHP Glpi

6.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network-reachable endpoint with high complexity per description; PR:N per provided CVSS 4.0 intelligence pending vendor clarification; confidentiality-only impact limited to document disclosure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 11:51 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.

AnalysisAI

Authorization bypass in GLPI 11.0.5 through 11.0.7 exposes restricted documents to unauthorized network-based access via a manipulable docid parameter in the document download handler. The vulnerability resides in the Document::canViewFile authorization check within front/document.send.php, where an attacker can tamper with the docid argument to circumvent document-level access controls and retrieve files they are not permitted to view. No public exploit has been identified at time of analysis, and EPSS data was not provided; however, the remote network vector with no required privileges raises concern for exposed GLPI deployments.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is a PHP-based open-source IT asset management and service desk platform. The affected component is the Document Handler, specifically the canViewFile method of the Document class located in front/document.send.php. This endpoint handles requests to retrieve stored documents by their identifier (docid). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of Insecure Direct Object Reference (IDOR) flaw where the application exposes an internal object key (docid) to the user and relies on a server-side authorization check that can be circumvented by providing a different, unintended key value. Rather than enforcing object-level access controls tied to the requesting user's session context, the authorization logic can be bypassed through key manipulation. Affected CPE: cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* with versions explicitly identified as 11.0.5, 11.0.6, and 11.0.7.

RemediationAI

No vendor-released patch has been identified at time of analysis - the references provided point exclusively to VulDB disclosure entries with no corresponding GLPI GitHub release, changelog, or official security advisory confirming a fix version. Organizations running GLPI 11.0.5, 11.0.6, or 11.0.7 should monitor the GLPI GitHub repository (github.com/glpi-project/glpi) and official security announcements for a patched release. As an interim compensating control, restrict access to front/document.send.php at the web server or reverse proxy layer to authenticated internal IP ranges only, reducing exposure for externally accessible GLPI deployments; note this trade-off is that externally shared document links would be broken. Additionally, review GLPI's document sharing configuration to disable anonymous document link features if not required, which would enforce session-based access as a prerequisite. Audit document access logs for anomalous docid enumeration patterns as a detection measure.