GLPI CVE-2026-13490

The vulnerability requires that the attacker can send HTTP requests to the front/document.send.php endpoint of a GLPI 11.0.5, 11.0.6, or 11.0.7 instance. The attack vector is network-accessible (AV:N), and the provided CVSS 4.0 vector indicates PR:N - meaning the endpoint may be reachable without prior authentication, though this is unconfirmed by a vendor advisory and warrants verification given GLPI's authenticated-platform nature. High attack complexity (AC:H) limits exploitation: the attacker must successfully enumerate or identify a valid docid belonging to a restricted document, and must craft the bypass in a way that circumvents the canViewFile logic, which is described as difficult. What limits exploitation further: no integrity or availability impact confines the attack to document exfiltration only; only documents indexed in GLPI's document store are at risk; and GLPI deployments restricted to internal networks or behind VPN significantly reduce the exposure surface.

The CVSS 4.0 score of 6.3 reflects a medium-severity finding with meaningful real-world constraints. The AC:H metric confirms high attack complexity - the description explicitly states exploitability is difficult, suggesting the bypass requires non-trivial request crafting or enumeration of valid docid values. The confidentiality impact is limited to VC:L with no integrity or availability consequences, narrowing the blast radius to unauthorized document disclosure. No KEV listing exists, no POC has been publicly disclosed, and EPSS data was not provided in the intelligence feed, making exploit probability difficult to quantify independently. The PR:N metric in the provided CVSS 4.0 vector warrants scrutiny: GLPI is an authenticated platform by design, and document-level IDOR typically requires at minimum a valid session. If the document.send.php endpoint is reachable without authentication (e.g., via shareable document links), PR:N is valid; if authentication is required and only document-level authorization is bypassed, PR:L is more accurate. This ambiguity should be verified against the GLPI 11.0.x documentation or vendor advisory. Overall, real-world risk is moderate - meaningful for environments storing sensitive IT documentation in GLPI, but constrained by high attack complexity and limited impact scope.

An attacker who can reach the GLPI web interface sends a crafted HTTP request to front/document.send.php with a sequentially or randomly enumerated docid value belonging to a document the attacker is not authorized to view. By bypassing the Document::canViewFile authorization check through key manipulation, the server returns the document contents regardless of the requesting party's permissions. The high attack complexity suggests this is not a trivial one-request exploit - the attacker likely needs to first identify valid docid values through enumeration or prior knowledge of the target's document identifiers.