CVE-2025-23024: GLPI Auth Bypass Vulnerability

CVE-2025-23024 Overview

GLPI is an open-source asset and IT management software package used by organizations to track infrastructure, tickets, and inventory. CVE-2025-23024 allows an unauthenticated remote attacker to disable all active plugins on a vulnerable GLPI instance by abusing the install/update.php file. The flaw affects versions from 0.72 up to but not including 10.0.18. Because plugins in GLPI often deliver security controls, authentication providers, and workflow logic, disabling them can degrade the integrity of the installation and interrupt operational services. The GLPI project addressed the issue in version 10.0.18.

Critical Impact
An anonymous network attacker can disable all active plugins on a GLPI instance, disrupting authentication providers, integrations, and other plugin-delivered functionality.

Affected Products

GLPI versions 0.72 through 10.0.17
GLPI 9.x branch (all releases)
GLPI 10.x releases prior to 10.0.18

Discovery Timeline

2025-02-25 - CVE-2025-23024 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23024

Vulnerability Analysis

CVE-2025-23024 is an improper authorization vulnerability [CWE-285] in the GLPI installation and update workflow. The install/update.php script is intended to run only during the initial setup or when administrators upgrade the application. In vulnerable releases, the script exposes plugin-management functionality without validating whether the requester is an authenticated administrator or whether an update is actually in progress. An anonymous attacker who can reach the GLPI web interface over the network can invoke this endpoint and toggle the state of every active plugin to disabled.

Because GLPI relies on plugins for capabilities such as single sign-on, LDAP integrations, custom fields, and helpdesk automation, disabling them removes controls that downstream users and services depend on. The vulnerability does not require credentials, user interaction, or elevated privileges.

Root Cause

The root cause is a missing authorization check on the update handler in install/update.php. The script trusts request parameters that instruct GLPI to disable plugins during an upgrade rather than confirming administrator identity or verifying that an upgrade session is legitimately underway.

Attack Vector

Exploitation is remote over HTTP or HTTPS against the GLPI web application. An attacker sends a crafted request to the install/update.php endpoint on a reachable GLPI instance. No authentication or user interaction is required. The result is a loss of availability for plugin-delivered features across the application. See the GitHub Security Advisory GHSA-885x-hvp2-85q8 for advisory details.

// No verified public proof-of-concept code is available.
// Refer to the GLPI security advisory for technical details.

Detection Methods for CVE-2025-23024

Indicators of Compromise

HTTP requests to install/update.php originating from unexpected client IP addresses, especially outside of maintenance windows.
GLPI audit or database records showing multiple plugins transitioning to a disabled state within a short time window.
User reports of missing authentication providers, integrations, or custom fields that were previously functional.

Detection Strategies

Monitor web server access logs for POST or GET requests to /install/update.php from unauthenticated sessions.
Query the glpi_plugins table periodically to detect unexpected changes to the state column indicating plugin deactivation.
Alert when the number of active plugins decreases without a corresponding administrator login or approved change ticket.

Monitoring Recommendations

Forward GLPI web server logs and application logs to a centralized SIEM for correlation with change management data.
Baseline the expected list of enabled plugins and generate alerts on deviations from that baseline.
Track access to installation and upgrade endpoints as high-signal events in web application firewall (WAF) telemetry.

How to Mitigate CVE-2025-23024

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.18 or later, which contains the official patch.
If an immediate upgrade is not possible, delete the install/update.php file from the GLPI installation directory as recommended by the vendor.
Review the current state of plugins on production instances and re-enable any that were disabled without authorization.

Patch Information

The fix is delivered in GLPI 10.0.18. Administrators should download the release from the official GLPI repository and follow the documented upgrade procedure. After patching, confirm the version reported by the application matches 10.0.18 or later and validate that the plugin state has not been altered.

Workarounds

Delete the install/update.php file from the GLPI web root after installation or upgrade completes.
Restrict network access to the GLPI web interface using firewall rules or reverse proxy access controls until patching is complete.
Place the install/ directory behind additional authentication at the web server layer, for example using HTTP basic authentication in Apache or NGINX.

bash

# Remove the vulnerable installer script after upgrading
rm /var/www/html/glpi/install/update.php

# Or restrict access at the web server layer (NGINX example)
# location ^~ /install/ {
#     deny all;
#     return 403;
# }