CVE-2025-53360: GLPI Database Inventory Auth Bypass Flaw

CVE-2025-53360 Overview

CVE-2025-53360 affects the pluginsGLPI Database Inventory Plugin, a component that coordinates Teclib' inventory agents to enumerate databases on managed workstations. In versions prior to 1.0.3, any authenticated user can send requests to inventory agents without holding the dedicated database_inventory right. The flaw is a broken access control issue tracked under CWE-284. Maintainers patched the issue in version 1.0.3 by enforcing right checks on the AJAX endpoint and massive-action handler.

Critical Impact
Any authenticated GLPI user can trigger inventory agent actions on managed computers, enabling unauthorized inventory operations and potential availability impact on agent workflows.

Affected Products

pluginsGLPI Database Inventory Plugin versions prior to 1.0.3
GLPI deployments using the Teclib' inventory agent integration
Environments where the plugin exposes ajax/agent.php to authenticated users

Discovery Timeline

2025-11-18 - CVE-2025-53360 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53360

Vulnerability Analysis

The Database Inventory Plugin exposes an AJAX endpoint (ajax/agent.php) that dispatches actions to Teclib' inventory agents. Before version 1.0.3, the endpoint only verified that the caller was authenticated through Session::checkLoginUser(). It did not enforce the database_inventory right or validate the caller's authorization against the target computer. As a result, any low-privileged authenticated user could POST an action and agent id and trigger inventory operations.

The server-side rendering of the action button used Session::checkRight incorrectly, calling a method that raises a fatal error path rather than performing a permission gate that returns cleanly. The underlying dispatch logic still executed because the AJAX handler itself lacked equivalent enforcement.

Root Cause

The root cause is missing authorization on a sensitive AJAX endpoint combined with an incorrect API call for right verification. The patch introduces Session::checkRight("inventory", READ) and later a dedicated database_inventory_run_inventory right in ajax/agent.php, and replaces Session::checkRight with Session::haveRight in inc/inventoryaction.class.php so the UI branch fails gracefully.

Attack Vector

Exploitation requires network access to the GLPI instance and any authenticated account. The attacker sends a crafted POST to ajax/agent.php with an action and target agent id. The vulnerability does not expose data confidentiality or integrity, but it allows unauthorized invocation of inventory workflows against managed computers.

php

// Patch 1 - inc/inventoryaction.class.php
// Replace fatal checkRight with non-fatal haveRight for UI branch
-        if (!Session::checkRight("database_inventory", PluginDatabaseinventoryProfile::RUN_DATABSE_INVENTORY)) {
+        if (!Session::haveRight("database_inventory", PluginDatabaseinventoryProfile::RUN_DATABSE_INVENTORY)) {
             return;
         }

// Patch 2 - ajax/agent.php
// Add server-side authorization on the AJAX endpoint
 Session::checkLoginUser();
+Session::checkRight("inventory", READ);
+$computer = new Computer();
+$computer->check($_POST['computers_id'], UPDATE);

// Patch 3 - ajax/agent.php (final hardening)
// Enforce dedicated database_inventory right
 Session::checkLoginUser();
 Session::checkRight("inventory", READ);
+Session::checkRight("database_inventory", PluginDatabaseinventoryProfile::RUN_DATABSE_INVENTORY);

Source: GitHub commits 0a376a0, 7dcad1e, and e9d4474

Detection Methods for CVE-2025-53360

Indicators of Compromise

POST requests to ajax/agent.php originating from user accounts that do not hold the database_inventory profile right.
Repeated partial_database_inventory massive actions triggered from unexpected user sessions.
Inventory agent activity on workstations that does not correlate to a scheduled inventory task or an administrator action.

Detection Strategies

Review GLPI web server access logs for requests to /plugins/databaseinventory/ajax/agent.php and correlate with the authenticated user and their assigned profile.
Audit the GLPI historical log for inventory actions attributed to non-privileged users.
Compare inventory agent execution timestamps against expected schedules to identify out-of-band triggers.

Monitoring Recommendations

Enable verbose logging on the GLPI application server and forward web access logs to a central log platform for correlation.
Alert on any HTTP POST to the plugin's AJAX endpoint from accounts lacking inventory administration privileges.
Monitor Teclib' agent-side logs for now? endpoint hits that lack a corresponding administrator-initiated task.

How to Mitigate CVE-2025-53360

Immediate Actions Required

Upgrade the pluginsGLPI Database Inventory Plugin to version 1.0.3 or later on all GLPI instances.
Review GLPI profiles and restrict the database_inventory right to administrative roles only.
Audit recent activity on ajax/agent.php to identify any unauthorized invocations prior to patching.

Patch Information

The fix is available in Database Inventory Plugin version 1.0.3. The maintainers applied three commits: 0a376a0 corrects the Session::checkRight misuse, 7dcad1e adds server-side authorization and target-computer validation to ajax/agent.php, and e9d4474 introduces a dedicated database_inventory_run_inventory right. See the GitHub Security Advisory GHSA-5j5j-xr62-jr58 for the full advisory.

Workarounds

Restrict network access to the GLPI web interface using an authenticating reverse proxy or IP allow-listing until the plugin is upgraded.
Temporarily disable the Database Inventory Plugin in the GLPI plugin manager if immediate patching is not feasible.
Reduce the number of accounts with any authenticated access to the GLPI instance to shrink the exploitable user population.

bash

# Verify installed plugin version and upgrade
cd /var/www/glpi/plugins/databaseinventory
git fetch --tags
git checkout 1.0.3

# Restart the web server to load patched files
systemctl restart apache2