CVE-2025-53111: GLPI Asset Management Auth Bypass Flaw

CVE-2025-53111 Overview

CVE-2025-53111 affects GLPI, an open-source Asset and IT Management Software package used by organizations to track infrastructure, tickets, and inventory. The vulnerability stems from missing permission checks in versions 0.80 through 10.0.18, allowing authenticated users to access resources they should not be authorized to view. The flaw is categorized under [CWE-284] Improper Access Control. Exploitation requires network access and low-privilege authentication, with impact focused on confidentiality of exposed data. The GLPI project resolved the issue in version 10.0.19.

Critical Impact
Authenticated attackers with low privileges can retrieve resources normally restricted by GLPI's authorization model, exposing sensitive asset, ticket, or configuration data.

Affected Products

GLPI versions 0.80 through 10.0.18
glpi-project/glpi (all deployments across the affected range)
GLPI 10.0.19 contains the fix

Discovery Timeline

2025-07-30 - CVE-2025-53111 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53111

Vulnerability Analysis

CVE-2025-53111 is a broken access control issue in GLPI. Certain resource endpoints do not enforce the permission checks that GLPI's role-based authorization model requires. An authenticated user can therefore request objects that fall outside their assigned rights profile and receive data the application should have rejected.

GLPI manages sensitive operational data including asset inventories, tickets, contracts, financial records, and user accounts. Missing authorization on any resource in this domain risks disclosure of internal IT information to lower-privileged users. The vulnerability affects a long release span, from GLPI 0.80 through 10.0.18, which increases exposure across long-lived deployments.

The flaw does not require user interaction and does not affect integrity or availability. Confidentiality impact is the primary concern.

Root Cause

The root cause is the absence of server-side permission verification on specific resource-handling code paths. GLPI relies on explicit right checks tied to user profiles, and those checks were not applied consistently. See the GLPI GitHub Security Advisory GHSA-p665-mqcr-j96j for the maintainer's technical description.

Attack Vector

Exploitation requires an authenticated GLPI session with any low-privileged account. The attacker sends crafted requests to the affected resource endpoints and retrieves data that the authorization layer should have blocked. No user interaction is needed. The vulnerability is network-reachable wherever the GLPI web interface is exposed.

No public proof-of-concept is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-53111

Indicators of Compromise

Unexpected HTTP requests from low-privileged GLPI accounts targeting resource endpoints normally reserved for administrators or technicians.
Access log entries showing successful 200 OK responses to resources that fall outside a user's assigned profile.
Anomalous spikes in read operations against sensitive object types such as tickets, assets, or user records.

Detection Strategies

Review GLPI application logs for authenticated sessions that query object types inconsistent with the account's role.
Compare user profile rights against actual resource access patterns to surface authorization anomalies.
Correlate web server access logs with GLPI account privilege levels to identify horizontal or vertical privilege escalation attempts.

Monitoring Recommendations

Forward GLPI web and application logs to a centralized logging platform for retention and query.
Alert on bulk enumeration behavior from single accounts, such as sequential ID-based resource fetches.
Track the GLPI version in use across all instances and flag any host still running 10.0.18 or earlier.

How to Mitigate CVE-2025-53111

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.19 or later without delay.
Audit user accounts and remove or downgrade unused low-privileged accounts that could be abused for authenticated access.
Review recent access logs for evidence of unauthorized resource retrieval by non-administrative accounts.

Patch Information

The GLPI project fixed CVE-2025-53111 in version 10.0.19. The patch adds the missing permission checks on the affected resource paths. Refer to the GLPI security advisory GHSA-p665-mqcr-j96j for release notes and upgrade guidance.

Workarounds

Restrict network access to the GLPI web interface using firewall rules or VPN gating until the upgrade is complete.
Enforce strong authentication and minimize the number of accounts with GLPI access to reduce the pool of potential exploiters.
Disable or remove unused GLPI plugins and features that expose additional resource endpoints.

bash

# Verify installed GLPI version and plan upgrade to 10.0.19
grep -R "GLPI_VERSION" /var/www/glpi/inc/define.php

# Example: back up the database before upgrading
mysqldump -u glpi -p glpi > glpi-backup-$(date +%F).sql