CVE-2025-53112: 
GLPI vulnerability analysis and mitigation

GLPI, a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing, has been found to contain a security vulnerability in versions 9.1.0 through 10.0.18. The vulnerability was discovered and disclosed on July 29, 2025, and was assigned CVE-2025-53112 (GitHub Advisory).

The vulnerability stems from a lack of permission checks in the system, which can lead to unauthorized removal of specific resources. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is categorized under CWE-862 (Missing Authorization) and CWE-284 (Improper Access Control) (NVD).

The vulnerability allows unauthorized actors to remove specific resources within the GLPI system, potentially affecting data integrity. The CVSS metrics indicate that while there is no impact on confidentiality or availability, there is a low impact on integrity of the system (GitHub Advisory).

The vulnerability has been fixed in GLPI version 10.0.19. Users are advised to upgrade to this version to mitigate the security risk (GitHub Advisory).