GLPI EUVD-2026-87280

Requires a valid authenticated GLPI session with a low-privilege account (PR:L) that can reach the knowledge-base comment/translation form endpoints (front/knowbaseitem_comment.form.php, front/knowbaseitemtranslation.form.php). No user interaction, no special non-default configuration, and no elevated role are needed - the flaw is that these endpoints omitted the per-item permission check entirely, so any authenticated user reaching them can act on KB comments/translations they lack rights to. Limiting factors: an account is mandatory (not remotely unauthenticated), and impact is bounded to integrity of KB comment and translation records only (no data disclosure, no code execution, no service disruption). Affected versions 0.85 through 10.0.25 / 11.0.x before 11.0.8.

This is a low-to-moderate-priority broken-access-control issue, not a high-severity flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with impact confined to VI:L (low integrity, no confidentiality, no availability) accurately reflects a limited-scope authorization gap: a low-privileged but authenticated GLPI user can create, update, or delete knowledge-base comments and translations they should not be able to touch. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation remains theoretical. SSVC data was not supplied. The one signal conflict worth flagging is the input Tag 'Authentication Bypass', which contradicts the actual weakness (CWE-285 Improper Authorization) - the flaw does not bypass authentication (PR:L requires a valid low-priv account) but bypasses per-item authorization checks. The patch commits confirm the root cause: form handlers omitted CommonDBTM per-record check() calls. Net real-world risk is low: it requires an existing account and only lets an attacker tamper with KB comment/translation content, not escalate privileges or read protected data.

A low-privileged authenticated GLPI user (e.g., a self-service or basic technician account) sends a crafted POST to front/knowbaseitem_comment.form.php or knowbaseitemtranslation.form.php referencing a knowledge-base item they lack rights over, and the server processes the create/update/delete because no per-item authorization check runs. The attacker can thereby alter or remove KB comments and translations belonging to restricted content. No public exploit code was identified, and exploitation requires a valid low-privilege session (PR:L, no user interaction).