CVE-2026-53631: 
GLPI vulnerability analysis and mitigation

CVE-2026-53631 is a missing authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package. Any authenticated user can craft a request to change the visibility settings of knowledge base items, reminders, or RSS feeds, thereby gaining unauthorized access to restricted content. The vulnerability affects GLPI versions from 0.83 up to (but not including) 10.0.27, and from 11.0.0 up to (but not including) 11.0.9. It was disclosed on November 4, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization). Two distinct code-level flaws were identified: first, the front-end form handlers for knowbaseitem.form.php, reminder.form.php, and rssfeed.form.php did not call $item->check(-1, CREATE, $_POST) before processing visibility relation additions, meaning no authorization check was performed before modifying visibility records. Second, a logic error in src/CommonDBRelation.php used a boolean OR instead of AND when evaluating whether write rights on both related items were required ($OneWriteIsEnough), allowing a user with read-only access to one item to bypass the write check on the other. An attacker only needs a valid authenticated session and low privileges to exploit this over the network with no user interaction required (GitHub Commit 6482e73, GitHub Commit 89ed992).

Successful exploitation allows an authenticated attacker to expand the visibility of knowledge base articles, reminders, or RSS feeds beyond their intended audience, and subsequently read content that should remain restricted. This results in a confidentiality breach (unauthorized access to sensitive organizational knowledge base data) and a limited integrity impact (unauthorized modification of visibility/access control settings). Availability is not affected, and there is no impact on subsequent/downstream systems. In environments where GLPI knowledge bases contain sensitive IT infrastructure details, credentials documentation, or internal procedures, this could facilitate further attacks or information gathering (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a low-privilege authenticated account, making it accessible to any GLPI user, but the limited impact scope reduces its attractiveness as a standalone attack vector.

1. Authenticate: Log in to the target GLPI instance with any valid user account (even a low-privilege account suffices).
2. Identify a restricted item: Browse or enumerate knowledge base articles, reminders, or RSS feeds that are not currently visible to your user account or that have restricted visibility settings.
3. Craft a malicious POST request: Using a tool such as Burp Suite or curl, craft an HTTP POST request to one of the vulnerable endpoints (/front/knowbaseitem.form.php, /front/reminder.form.php, or /front/rssfeed.form.php) with parameters that add a visibility relation (e.g., reminders_id=<target_id> and users_id=<your_user_id> or a group/entity identifier) to expand the item's visibility.
4. Bypass authorization: Because the server does not call the authorization check ($item->check(-1, CREATE, $_POST)) before processing the relation addition, the request is accepted regardless of whether the attacker has update rights on the target item.
5. Access restricted content: After successfully modifying the visibility settings, navigate to the previously restricted knowledge base item, reminder, or RSS feed and read its contents (GitHub Commit 6482e73, GitHub Advisory).

• Logs: Unexpected POST requests in the GLPI web server access logs targeting /front/knowbaseitem.form.php, /front/reminder.form.php, or /front/rssfeed.form.php from users who do not normally manage these resources, particularly with parameters such as reminders_id, knowbaseitems_id, or rssfeeds_id combined with users_id or entity/group identifiers.
• Application Activity: Sudden changes in visibility settings of knowledge base items, reminders, or RSS feeds — especially items becoming visible to users or groups that previously had no access — as reflected in GLPI's audit/event logs.
• User Behavior: Low-privilege users accessing knowledge base articles or reminders that were previously restricted to administrators or specific groups, which may appear in GLPI's item access history.

GLPI has released patched versions addressing this vulnerability: 10.0.27 (for the 10.x branch) and 11.0.9 (for the 11.x branch). The fix adds a proper authorization check ($item->check(-1, CREATE, $_POST)) in the form handlers for knowledge base items, reminders, and RSS feeds, and corrects the boolean logic error in CommonDBRelation.php. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Administrators should also review GLPI event logs for any unauthorized visibility changes that may have occurred prior to patching (GLPI Release 10.0.27, GLPI Release 11.0.9).

The vulnerability was credited to researchers Mitchell45 and 360AlphaLab (finders) and SebSept (reporter), as acknowledged in the GitHub Security Advisory. The fix was developed by AdrienClairembault and committed by cedric-anne. The release notes for both 10.0.27 and 11.0.9 classify this as a "Medium" severity security issue and recommend upgrading, noting it alongside several higher-severity fixes in the same release cycle (GitHub Advisory, GLPI Release 11.0.9).