CVE-2025-64520: 
GLPI vulnerability analysis and mitigation

CVE-2025-64520 is a Missing Authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package. An unauthorized user with API access can read all knowledge base entries, including those restricted by visibility settings. The vulnerability affects GLPI versions 9.1.0 through 10.0.20 (prior to 10.0.21) and was disclosed on December 16, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Security Advisory, reflecting network-accessible exploitation with low privileges required (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): the GLPI search functionality did not apply knowledge base visibility restrictions when processing API requests, allowing any authenticated API user to retrieve knowledge base items regardless of their configured access permissions. The fix, committed in src/Search.php, adds the missing KnowbaseItem::addVisibilityRestrict() and KnowbaseItem::addVisibilityJoins() calls to the addDefaultWhere and addDefaultJoin methods respectively, ensuring that KB item visibility rules are enforced during search queries (GitHub Commit). Exploitation requires only a valid API token or low-privileged API credentials — no special permissions or user interaction are needed (GitHub Advisory).

Successful exploitation allows an attacker with any API access to read all knowledge base entries in GLPI, including those restricted to specific users, groups, or profiles. This can expose sensitive internal documentation, IT procedures, credentials, or configuration details stored in the knowledge base. The impact is limited to confidentiality (no integrity or availability impact), but the exposed data could facilitate further attacks or lateral movement within the organization's IT environment (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability was reported by security researcher "rootjog" and disclosed through GitHub's coordinated disclosure process. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain API Access: Acquire a valid GLPI API token or low-privileged user credentials with API access enabled on the target GLPI instance (versions 9.1.0–10.0.20).
2. Authenticate to the API: Initiate a session via the GLPI REST API endpoint (e.g., GET /apirest.php/initSession) using the obtained credentials to retrieve a session token.
3. Query Knowledge Base Items: Send an authenticated API request to search or list knowledge base items (e.g., GET /apirest.php/KnowbaseItem or via the search endpoint), which due to the missing authorization check will return all KB entries regardless of their configured visibility restrictions.
4. Exfiltrate Restricted Data: Enumerate and download all knowledge base entries, including those intended to be restricted to specific users or groups, potentially exposing sensitive internal IT documentation (GitHub Advisory, GitHub Commit).

• Network: Unusual or high-volume API requests to GLPI REST API endpoints such as /apirest.php/KnowbaseItem or /apirest.php/search/KnowbaseItem from unexpected source IPs or service accounts.
• Logs: GLPI access logs showing repeated API calls to knowledge base search endpoints by users or API tokens that do not normally access KB content; API sessions initiated outside of normal business hours.
• Application: API tokens being used from unfamiliar IP addresses or user agents; bulk enumeration patterns in API request logs (sequential item ID requests or large result set queries).

Users should upgrade GLPI to version 10.0.21 or later, which includes the patch adding missing knowledge base visibility restrictions to the search functionality (GitHub Advisory, GitHub Commit). No official workaround is provided for those unable to upgrade immediately; as a temporary measure, administrators may consider disabling API access for untrusted or low-privileged users, or restricting API access at the network level until the patch can be applied. Review and audit API token assignments to ensure only necessary users have API access.

The vulnerability was credited to researcher "rootjog" and published via GitHub's security advisory process on December 16, 2025. Coverage has been picked up by standard vulnerability tracking services including ENISA's EUVD, CIRCL's vulnerability lookup, and security news aggregators, but no significant independent researcher commentary or major media coverage has been identified (GitHub Advisory).