CVE-2025-64520: GLPI Information Disclosure Vulnerability

CVE-2025-64520 Overview

CVE-2025-64520 is an authorization flaw in GLPI, an open-source IT asset and service management platform. The vulnerability allows an authenticated API user to read all knowledge base entries, including items the user should not have permission to view. The issue affects GLPI versions starting at 9.1.0 and prior to 10.0.21. The root cause is a missing visibility restriction when the search layer handles the KnowbaseItem item type via the API. The GLPI project addressed the issue in release 10.0.21 by applying the proper visibility filter. The flaw is categorized under CWE-862: Missing Authorization.

Critical Impact
Any user with valid API access can enumerate and read every knowledge base entry, exposing internal documentation, operational procedures, and potentially sensitive technical notes.

Affected Products

GLPI versions 9.1.0 through 10.0.20
GLPI deployments exposing the REST API to authenticated users
Self-hosted GLPI instances maintained by the glpi-project

Discovery Timeline

2025-12-16 - CVE-2025-64520 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2025-64520

Vulnerability Analysis

GLPI exposes a search mechanism that applies per-item-type visibility restrictions before returning results. These restrictions enforce the access control model that governs which users can view which records. The search dispatcher in src/Search.php contains a switch block that appends visibility SQL for item types such as PlanningExternalEvent. The handler for KnowbaseItem was missing from this block. When a request targeted the knowledge base item type through the API, no visibility clause was added to the generated query. The database then returned every row, bypassing the per-entry audience rules normally enforced by KnowbaseItem::addVisibilityRestrict().

Root Cause

The root cause is a missing authorization check [CWE-862] in the search pipeline. The code path responsible for building visibility conditions did not include a case for the KnowbaseItem type. Entry-level access control depends on this call, so its absence collapsed the authorization boundary for knowledge base reads initiated through the API.

Attack Vector

An attacker needs valid API credentials for the target GLPI instance. Low-privilege accounts, including those typically assigned to self-service users, are sufficient. The attacker issues a search request against the KnowbaseItem resource through the GLPI REST API and receives entries beyond the ones permitted by their role. No user interaction is required, and the operation is read-only.

php

                $condition .= PlanningExternalEvent::addVisibilityRestrict();
                break;

+            case 'KnowbaseItem':
+                $condition .= \KnowbaseItem::addVisibilityRestrict();
+                break;
+
            default:
                // Plugin can override core definition for its type
                if ($plug = isPluginItemType($itemtype)) {
// Source: https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3

The patch adds the missing case so the search builder applies KnowbaseItem::addVisibilityRestrict() to the generated SQL condition.

Detection Methods for CVE-2025-64520

Indicators of Compromise

Unusual volume of API requests targeting the KnowbaseItem endpoint from a single authenticated session.
API searches against KnowbaseItem returning more records than the calling user would normally be entitled to view.
Low-privilege API tokens making repeated enumeration-style requests to the search endpoint.

Detection Strategies

Review GLPI access logs for apirest.php or search calls referencing KnowbaseItem and compare returned record counts against the caller's expected scope.
Correlate API token identifiers with their assigned entities and profiles to flag broad reads from narrowly scoped accounts.
Alert on first-time use of KnowbaseItem search by API tokens that historically only queried assets or tickets.

Monitoring Recommendations

Forward GLPI web server logs and application logs to a centralized logging platform for query and retention.
Track baseline API usage per token and raise alerts when request volume or record retrieval deviates from the baseline.
Monitor privileged knowledge base entries for unexpected read patterns following any token issuance or role change.

How to Mitigate CVE-2025-64520

Immediate Actions Required

Upgrade GLPI to version 10.0.21 or later, which contains the official patch.
Audit active API clients and revoke tokens that are no longer required or that belong to inactive users.
Review knowledge base entries for content that must remain restricted and reassess the audience configuration after patching.

Patch Information

The fix is published in GLPI 10.0.21. The change adds a KnowbaseItem case to the visibility switch in src/Search.php, invoking KnowbaseItem::addVisibilityRestrict(). Patch details are available in the GLPI commit a3d5cc4 and the GHSA-62p9-prpq-j62q advisory.

Workarounds

Disable the REST API in GLPI configuration until the upgrade can be scheduled.
Restrict API access at the network layer so only trusted administrative hosts can reach apirest.php.
Temporarily remove or relocate highly sensitive content from the GLPI knowledge base pending remediation.

bash

# Example: block external access to the GLPI API at the reverse proxy (nginx)
location /apirest.php {
    allow 10.0.0.0/8;
    deny all;
}