CVE-2025-27153: GLPI Escalade Plugin Auth Bypass Flaw

CVE-2025-27153 Overview

CVE-2025-27153 is an improper access control vulnerability [CWE-284] in the Escalade plugin for GLPI, an open-source IT service management platform. The Escalade plugin helps automate ticket escalation workflows within GLPI. Versions prior to 2.9.11 fail to enforce proper authorization checks, allowing unauthenticated network-based access to restricted functionality. Successful exploitation can expose ticket data and disrupt escalation workflows. The maintainers released a fix in version 2.9.11.

Critical Impact
Unauthenticated attackers can reach the network-exposed endpoint with low attack complexity, resulting in limited confidentiality and integrity impact through data exposure and workflow disruption.

Affected Products

Escalade GLPI plugin versions prior to 2.9.11
GLPI environments using the Escalade ticket escalation helper
Any exposed GLPI web instance loading the vulnerable plugin

Discovery Timeline

2025-07-01 - CVE-2025-27153 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27153

Vulnerability Analysis

The Escalade plugin extends GLPI with automated ticket escalation logic, adding routes and actions consumed by help desk staff. The vulnerability stems from missing or insufficient access control checks on plugin functionality. An attacker reaching the plugin over the network can invoke restricted operations without proper authorization. The consequence is exposure of ticket-related information and disruption of the escalation workflow that support teams rely on for prioritization. The flaw is classified under [CWE-284] Improper Access Control. The Exploit Prediction Scoring System (EPSS) currently indicates a low probability of near-term exploitation, but internet-exposed GLPI instances remain attractive targets due to their central role in IT operations. No public proof-of-concept exploit or evidence of exploitation in the wild has been recorded.

Root Cause

The plugin does not consistently verify that the requesting user holds the privileges required to perform sensitive operations. Authorization logic is either missing or applied only at the interface layer rather than at the server-side handler. This leaves back-end routes reachable without the expected role checks enforced by GLPI's permission model.

Attack Vector

Exploitation requires only network access to a GLPI instance running a vulnerable Escalade plugin. No user interaction and no prior authentication are required. An attacker crafts a request targeting the plugin's exposed endpoints to retrieve ticket data or trigger workflow actions that should be restricted. Technical details are documented in the GitHub Security Advisory GHSA-pvqv-8r3r-47m9.

Detection Methods for CVE-2025-27153

Indicators of Compromise

Unexpected access to Escalade plugin endpoints from unauthenticated sessions or unfamiliar IP addresses
Ticket records showing viewing or modification events without a corresponding authenticated user in GLPI logs
Anomalous escalation state changes on tickets that do not match documented workflows

Detection Strategies

Review GLPI application and web server logs for requests to plugin paths under /plugins/escalade/ originating from sessions lacking valid authentication cookies
Correlate ticket audit history with GLPI authentication logs to identify actions attributed to unauthenticated or unexpected principals
Monitor for repeated requests to plugin endpoints returning HTTP 200 where 401 or 403 responses would be expected

Monitoring Recommendations

Forward GLPI web and application logs into a centralized analytics platform for query and long-term retention
Alert on spikes in plugin endpoint traffic or on ticket enumeration patterns
Track plugin version inventory across GLPI deployments to identify hosts still running versions below 2.9.11

How to Mitigate CVE-2025-27153

Immediate Actions Required

Upgrade the Escalade plugin to version 2.9.11 or later on all GLPI instances
Audit GLPI ticket history for unauthorized access or unexpected escalation actions occurring before the patch
Restrict network exposure of GLPI administrative interfaces to trusted networks or VPN access

Patch Information

The vulnerability is fixed in Escalade plugin version 2.9.11. Release notes and downloads are available at GitHub Escalade Release 2.9.11. Administrators should replace the plugin files under the GLPI plugins/escalade directory and reload the plugin from the GLPI plugin manager.

Workarounds

Temporarily disable the Escalade plugin in the GLPI plugin manager until the upgrade is applied
Place GLPI behind a web application firewall and block external requests to /plugins/escalade/ paths
Enforce IP allow-listing on the GLPI web server for administrative and help desk users

bash

# Upgrade Escalade plugin to patched version
cd /var/www/html/glpi/plugins
rm -rf escalade
wget https://github.com/pluginsGLPI/escalade/releases/download/2.9.11/escalade.tar.bz2
tar -xjf escalade.tar.bz2
chown -R www-data:www-data escalade
# Then activate the updated plugin via GLPI's Setup > Plugins interface