CVE-2025-53111: 
GLPI vulnerability analysis and mitigation

GLPI, a Free Asset and IT Management Software package, was found to contain a security vulnerability affecting versions 0.80 through 10.0.18. The vulnerability was disclosed on July 29, 2025, and involves a lack of permission checks that could lead to unauthorized access to system resources (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires no user interaction, has unchanged scope, and can result in high confidentiality impact without affecting integrity or availability. The vulnerability has been classified under CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization) (AttackerKB, GitHub Advisory).

The vulnerability allows unauthorized actors to access certain system resources, potentially exposing sensitive information. The high confidentiality impact rating suggests that unauthorized access could result in significant data exposure (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.19. Users are advised to upgrade to this version to mitigate the security risk (GitHub Advisory).