Is there a patch available for CVE-2026-42320?

Yes, a patch is available for CVE-2026-42320. Update the affected software to the latest version immediately.

GLPI CVE-2026-42320

Q: What is the CVSS score of CVE-2026-42320?

CVE-2026-42320 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34096 MEDIUM

Missing Authorization (CWE-862)

2026-06-03 GitHub_M

Authentication Bypass Glpi

5.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:33 vuln.today

Patch available

Jun 03, 2026 - 17:01 EUVD

CVSS changed

Jun 03, 2026 - 16:22 NVD

5.9 (MEDIUM)

CVE Published

Jun 03, 2026 - 15:23 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

AnalysisAI

Arbitrary file read within GLPI_DOC_DIR is exploitable by authenticated technicians in GLPI versions 0.50 through 10.0.24 and 11.0.0 through 11.0.6, stemming from missing authorization controls (CWE-862) on document directory access. An attacker holding a technician-level account can read any file stored under the GLPI_DOC_DIR path without appropriate privilege checks, exposing potentially sensitive documents, attachments, or internal data. No public exploit is identified at time of analysis, and CISA's SSVC framework rates exploitation as none with non-automatable attack paths.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is an open-source IT asset and service management platform. The vulnerability is rooted in CWE-862 (Missing Authorization): the application fails to enforce access controls verifying that a technician-role user is authorized to retrieve arbitrary files from the GLPI_DOC_DIR storage directory - the directory where GLPI stores uploaded documents and attachments. The affected codebase spans the entire product history from version 0.50. CPE data (cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*) confirms the vulnerability is scoped to all GLPI application instances regardless of OS or deployment platform. The 'Authentication Bypass' tag accompanying this CVE likely refers to authorization bypass rather than authentication bypass - the technician role is authenticated but bypasses the authorization layer that should restrict file access scope.

RemediationAI

Upgrade to GLPI 10.0.25 or GLPI 11.0.7 - both versions contain the vendor-released patch addressing this authorization gap, as confirmed by the GitHub security advisory GHSA-58j6-94cf-gcx5. Organizations unable to patch immediately should restrict technician-role accounts to only those users with a verified operational need, reducing the pool of potential abusers. Additionally, consider auditing the contents of GLPI_DOC_DIR to ensure no sensitive files (credentials, configuration exports, or PII-containing attachments) are stored there, and apply OS-level read permissions to limit the GLPI web process user's access scope as a compensating control. Note that restricting OS permissions on GLPI_DOC_DIR may break legitimate document retrieval workflows and should be tested in a non-production environment first.