CVE-2026-13490: 
GLPI vulnerability analysis and mitigation

CVE-2026-13490 is an authorization bypass vulnerability in the Document Handler component of glpi-project GLPI (IT asset management software), specifically affecting the Document::canViewFile function in front/document.send.php. Manipulation of the docid argument allows an unauthenticated remote attacker to bypass authorization checks and access restricted documents. The vulnerability affects GLPI versions 11.0.5, 11.0.6, and 11.0.7. It was published on June 28, 2026, with the vendor contacted prior to disclosure. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, VulDB).

The root cause is classified under CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability exists because the Document::canViewFile function in front/document.send.php does not properly validate whether the requesting user is authorized to access the document identified by the docid parameter — an attacker-controlled value. By manipulating the docid argument in a crafted HTTP request, an unauthenticated remote attacker can retrieve documents they are not permitted to view. Exploitation is characterized as high complexity, meaning specific conditions or non-trivial techniques are required to successfully exploit the flaw (GitHub Advisory, VulDB).

Successful exploitation results in unauthorized disclosure of documents stored within the GLPI instance, impacting confidentiality. There is no impact to integrity or availability. Depending on the sensitivity of documents managed in GLPI (e.g., IT infrastructure records, credentials, contracts, or personal data), exposure could facilitate further attacks or compliance violations. The scope is limited to the vulnerable system, with no evidence of lateral movement potential directly from this vulnerability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing GLPI instances running versions 11.0.5, 11.0.6, or 11.0.7 using search engines (e.g., Shodan, Censys) or by probing the GLPI login page for version disclosure.
2. Identify target endpoint: Locate the document serving endpoint at front/document.send.php, which handles document download/view requests via the docid parameter.
3. Enumerate document IDs: Attempt to enumerate valid docid values through sequential or predictable ID manipulation (e.g., front/document.send.php?docid=1, docid=2, etc.), leveraging the authorization bypass to access documents without authentication.
4. Bypass authorization: Craft an HTTP GET or POST request to front/document.send.php with a manipulated docid value corresponding to a restricted document, exploiting the flawed Document::canViewFile check.
5. Retrieve restricted documents: If the bypass succeeds under the required high-complexity conditions, the server returns the document content, exposing potentially sensitive files stored in the GLPI document repository (GitHub Advisory, VulDB).

• Network: Unusual or repeated unauthenticated HTTP requests to front/document.send.php with varying docid parameter values from a single or small set of IP addresses; sequential or enumeration-style docid values in request logs.
• Logs: Web server access logs showing requests to front/document.send.php?docid=<value> without a valid authenticated session cookie; HTTP 200 responses to unauthenticated document requests that should return 403 or redirect to login.
• Application Logs: GLPI application logs recording document access events for documents not associated with any authenticated user session.

Users should upgrade GLPI to a version beyond 11.0.7 once a patched release is made available by the glpi-project. As an interim workaround, restrict network-level access to the front/document.send.php endpoint using a web application firewall (WAF) or reverse proxy rules to allow only authenticated sessions. Additionally, monitor and log all access to the document handler endpoint for anomalous docid parameter patterns. Implementing additional server-side authorization validation for document access is also recommended (GitHub Advisory).

The vulnerability received automated notifications via CVEnew on X (Twitter) and Bluesky shortly after publication. No significant researcher commentary, vendor blog posts, or media coverage has been identified beyond standard vulnerability database aggregation. The GitHub Advisory Database has classified it as "Moderate" severity and marked it as unreviewed, with no associated package fix versions listed (GitHub Advisory).