GLPI CVE-2026-53626

Requires an authenticated GLPI account (versions 11.0.5 through before 11.0.8) with legitimate permission to view at least one item; the attacker supplies that permitted item as the linkage context (itemtype/items_id) in a document-view request while targeting a document attached to an item they cannot access. The flaw is in the document permission path (canViewFileFromItem and checkAvailability in Document.php) which confirmed only that the document was linked to some item, not to the targeted accessible one. Limiting factors: valid credentials are required (no unauthenticated access), impact is confined to reading documents (no modification or DoS), and only environments storing sensitive attachments on access-restricted items are meaningfully at risk.

This is a genuine but moderate-severity authorization flaw, not a high-CVSS-but-hollow issue. The NVD CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly captures a network-reachable, low-complexity, authenticated flaw with confidentiality-only impact (no integrity or availability effect), which aligns with the description of unauthorized document reads. No EPSS score, no CISA KEV listing, and no public POC were provided; per rules this is 'no public exploit identified at time of analysis,' though the fix commit and its added regression test (testLinkedDocumentsCantBeViewedOnUnrelatedItem) effectively disclose the exploitation pattern, lowering the bar for a motivated attacker. No SSVC decision data was supplied. The key limiting factor is PR:L: the attacker must already be an authenticated GLPI user with legitimate view rights to at least one unrelated item, so this is a horizontal/privilege-scoped information-disclosure issue rather than a pre-auth breach. Real priority is moderate - meaningful for GLPI operators storing sensitive documents (contracts, incident attachments) but gated by requiring valid credentials. The 'Authentication Bypass' tag is misleading: CWE-639 and the fix confirm this is an authorization (IDOR/broken object-level access) flaw, not an authentication bypass.

An authenticated GLPI user with permission to view one item (e.g. a Form or Question they legitimately own) crafts a document-view request that references that permitted item as the linkage context while pointing at a document actually attached to an item they are not allowed to see. Because the permission check only confirmed the document was linked to *some* item rather than to the *targeted* accessible item, GLPI serves the restricted file. No public exploit code was identified, though the vendor's fix and added test case illustrate the exact technique.