CVE-2026-53626: GLPI Authentication Bypass Vulnerability

CVE-2026-53626 Overview

CVE-2026-53626 is a broken access control vulnerability [CWE-639] in GLPI, a free, open-source asset and IT management software package. The flaw exists in versions 11.0.5 through 11.0.7 and was fixed in 11.0.8. Under specific conditions, GLPI's permission logic grants access to a document without verifying that the document is actually linked to the targeted item. An authenticated user can reference an unrelated item they are permitted to view and read a document that is linked to an item they should not be able to access. This exposes confidential documents stored within the GLPI instance to users holding only low-privilege accounts.

Critical Impact
Authenticated low-privilege users can read documents attached to items they are not authorized to view, resulting in confidentiality loss across the GLPI asset repository.

Affected Products

GLPI 11.0.5
GLPI 11.0.6
GLPI 11.0.7

Discovery Timeline

2026-09-25 - CVE-2026-53626 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-53626

Vulnerability Analysis

The vulnerability resides in the document access control path implemented in src/Document.php, specifically in the canViewFileFromItem($itemtype, $items_id) method. GLPI determines whether a user may view a document by checking permissions on an associated item. The pre-patch logic confirms that the user can view the supplied item but does not verify that the requested document is actually linked to that item. An attacker supplies an itemtype and items_id pair they legitimately have access to, together with the identifier of a document attached to a different, inaccessible item. The server returns the document contents, bypassing the owning item's access controls. This is a classic authorization flaw tracked under CWE-639: Authorization Bypass Through User-Controlled Key, often described as an Insecure Direct Object Reference (IDOR).

Root Cause

The permission check validates authorization on the referenced item rather than on the relationship between the item and the document. Because document-to-item linkage is not enforced during the lookup, any valid item the attacker can view acts as a universal key for retrieving arbitrary documents.

Attack Vector

Exploitation requires a valid authenticated session with low privileges. The attacker issues a document download or preview request through the standard GLPI web interface, substituting the itemtype and items_id parameters with values pointing to any item they can access. The targeted document identifier is supplied directly. No user interaction and no elevated privileges are required.

php

     */
    private function canViewFileFromItem($itemtype, $items_id): bool
    {
-        global $DB;
-
        if (!is_a($itemtype, CommonDBTM::class, true)) {
            return false;
        }

Source: GLPI commit e984bf1. The patch rewrites canViewFileFromItem so that the method verifies the document-to-item relationship before granting access, closing the authorization gap.

Detection Methods for CVE-2026-53626

Indicators of Compromise

Repeated document access requests from a single authenticated session referencing many distinct documents_id values paired with the same itemtype/items_id.
Document retrievals where the requesting user has no direct permission on the item the document is actually linked to in the GLPI database.
Access patterns in which low-privilege accounts download documents originally attached to restricted tickets, assets, or projects.

Detection Strategies

Correlate GLPI application logs with database records to identify document fetches that cannot be explained by the user's effective permissions on the owning item.
Deploy web application firewall or reverse-proxy rules that log all requests to document endpoints together with the referenced itemtype, items_id, and documents_id parameters.
Review audit trails for anomalous spikes in document views by individual users, especially outside their normal entity scope.

Monitoring Recommendations

Enable verbose logging on GLPI document controllers and ingest the logs into a centralized SIEM for retention and correlation.
Alert when a single account retrieves documents linked to items distributed across multiple entities within a short time window.
Monitor for authenticated enumeration behavior such as sequential increments of documents_id parameters.

How to Mitigate CVE-2026-53626

Immediate Actions Required

Upgrade all GLPI instances running 11.0.5, 11.0.6, or 11.0.7 to version 11.0.8 without delay.
Audit document access logs since the deployment of any affected release to identify potentially unauthorized disclosures.
Rotate or revoke sensitive attachments known to have been exposed through affected versions where feasible.

Patch Information

The fix is included in GLPI 11.0.8. Technical details are available in the GitHub Security Advisory GHSA-q9rc-v6vm-q5mm and the corresponding upstream commit. Applying the patched release is the only supported remediation.

Workarounds

No official workaround is published by the vendor; upgrading to 11.0.8 is the sanctioned fix.
As a temporary compensating control, restrict access to the GLPI instance to trusted networks using VPN or IP allow-listing until the upgrade is completed.
Review and tighten role-based access so that users without a legitimate need do not hold any item-view permissions that could be abused as the pivot in the attack.

bash

# Example upgrade workflow for a self-hosted GLPI instance
php bin/console glpi:maintenance:enable
wget https://github.com/glpi-project/glpi/releases/download/11.0.8/glpi-11.0.8.tgz
tar -xzf glpi-11.0.8.tgz -C /var/www/
php bin/console db:update
php bin/console glpi:maintenance:disable