CVE-2025-53105: GLPI Privilege Escalation Vulnerability

CVE-2025-53105 Overview

CVE-2025-53105 is a privilege escalation vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), an open-source IT asset and service management platform. The flaw allows an authenticated user without administrative rights to alter the execution order of GLPI rules. Rule ordering controls how business logic, ticket assignments, and authorization decisions are processed within GLPI. The issue affects versions 10.0.0 through 10.0.18 and is patched in version 10.0.19. The vulnerability is tracked under CWE-269: Improper Privilege Management.

Critical Impact
A low-privileged authenticated user can manipulate GLPI rule processing order, undermining ticket routing, authorization decisions, and other administrative controls enforced through the rules engine.

Affected Products

GLPI versions 10.0.0 through 10.0.18
GLPI Service Desk and ITIL workflow modules relying on the rules engine
GLPI deployments exposing authenticated user access over the network

Discovery Timeline

2025-08-27 - CVE-2025-53105 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53105

Vulnerability Analysis

The vulnerability resides in GLPI's rules management subsystem. GLPI uses ordered rule sets to evaluate business logic such as ticket categorization, asset assignment, and authorization mappings. The application failed to enforce administrative privilege checks on the endpoint that reorders rules. As a result, any authenticated user could submit a request to change the rule execution order. The classification under CWE-269 indicates improper privilege management on a sensitive administrative function. Attack complexity is high because successful exploitation depends on knowledge of the target rule set and how reordering produces a useful security impact.

Root Cause

The root cause is missing authorization enforcement on the rule-ordering action. The handler responsible for updating rule ranks did not validate that the requesting session held the required administrative profile. Authentication alone was treated as sufficient to perform the operation.

Attack Vector

An attacker requires valid GLPI credentials with no administrative role. The attacker sends an HTTP request to the rule management endpoint to move, promote, or demote rules within an ordered set. Reordering rules can short-circuit security-relevant logic, force tickets into privileged categories, or alter LDAP and authorization rule evaluation. The vulnerability is reachable over the network without user interaction. No verified public proof-of-concept is currently listed for CVE-2025-53105. See the GHSA-334r-2682-95wc advisory for vendor technical details.

Detection Methods for CVE-2025-53105

Indicators of Compromise

Unexpected changes to the ranking column in GLPI rule tables such as glpi_rules outside of administrator-driven changes.
HTTP POST requests to GLPI rule management endpoints originating from non-administrator session cookies.
Audit log entries showing rule reordering events with no corresponding administrator user context.
Sudden changes in ticket routing, category assignment, or authorization outcomes without configuration commits.

Detection Strategies

Compare current GLPI rule ordering against a known-good baseline exported from a trusted version.
Enable verbose GLPI logging and parse glpi/files/_log/event.log for rule modification events tied to non-admin accounts.
Inspect web server access logs for requests to rule administration URLs paired with low-privilege session identifiers.
Correlate authentication logs with rule-table modification timestamps to identify unauthorized actors.

Monitoring Recommendations

Forward GLPI application and web server logs to a centralized SIEM for retention and alerting.
Create alerts that trigger on database writes to glpi_rules and related ranking tables.
Monitor for accounts performing administrative actions outside their assigned profile.
Review GLPI user profile assignments regularly to limit the population of users able to authenticate to the application.

How to Mitigate CVE-2025-53105

Immediate Actions Required

Upgrade GLPI to version 10.0.19 or later, which contains the official fix.
Audit current rule ordering against a backup taken before August 2025 and revert unauthorized changes.
Rotate credentials for accounts suspected of unauthorized rule modifications.
Restrict network access to the GLPI web interface so only intended users can reach authenticated endpoints.

Patch Information

The GLPI project released version 10.0.19 to remediate CVE-2025-53105. The fix enforces administrative authorization on the rule-ordering action. Patch details and downloads are available in the GLPI 10.0.19 release notes and the GHSA-334r-2682-95wc security advisory.

Workarounds

Limit GLPI account creation and disable self-registration to reduce the population of authenticated users.
Place GLPI behind a VPN or zero-trust gateway to restrict network reachability to trusted personnel.
Apply web application firewall rules that block non-admin sessions from posting to rule management URLs until the patch is applied.
Take and store regular database backups of GLPI rule tables to enable rapid restoration if tampering is detected.

bash

# Upgrade GLPI to the patched version on a typical Linux deployment
cd /var/www/html
php bin/console glpi:maintenance:enable
wget https://github.com/glpi-project/glpi/releases/download/10.0.19/glpi-10.0.19.tgz
tar -xzf glpi-10.0.19.tgz -C /opt/glpi-stage
rsync -a --delete /opt/glpi-stage/glpi/ /var/www/html/glpi/
php /var/www/html/glpi/bin/console db:update
php /var/www/html/glpi/bin/console glpi:maintenance:disable