CVE-2026-57152: 
GLPI vulnerability analysis and mitigation

CVE-2026-57152 is a Missing Authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package, described as "Unallowed notifications sending." Under certain conditions, GLPI's permission logic could grant a user access to a document without confirming that the document was actually linked to the targeted item, potentially exposing files to unauthorized users. The vulnerability affects GLPI versions from 0.85 up to (but not including) 10.0.26, and from 11.0.0 up to (but not including) 11.0.8. It was published on November 4, 2026, and credited to researcher Shad0wMazt3r. It carries a CVSS v4.0 base score of 7.1 (High) per Feedly/EUVD, though the GitHub Security Advisory rates it as Moderate (6.0) (GitHub Advisory, GLPI Release 10.0.26).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerability resides in the QueuedNotification class (src/QueuedNotification.php), where the canCreate() method was implemented to allow any authenticated user (human or cron) to create notification queue entries by simply checking for a valid login session (Session::getLoginUserID(false)), without verifying whether the associated document was properly linked to the targeted item. This flawed permission check allowed an authenticated low-privileged user to trigger document access outside their authorized scope. The fix involved removing the overly permissive canCreate() override entirely, reverting to the parent class's stricter authorization logic (GitHub Advisory, Fix Commit 8a71d58, Fix Commit dcabe7c).

Successful exploitation allows an authenticated low-privileged user to access documents they are not authorized to view by bypassing GLPI's item-document linkage verification. The primary impact is an integrity violation — unauthorized users can send notifications or access document content that should be restricted — with no direct availability impact. In IT asset management environments, exposed documents may contain sensitive operational data such as configuration files, contracts, or personal information, representing a meaningful confidentiality risk despite the CVSS metric indicating no confidentiality impact at the system level (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-57152. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) authenticated account on the GLPI instance, reducing the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Feedly).

GLPI has released patched versions addressing this vulnerability: 10.0.26 (for the 0.85–10.x branch) and 11.0.8 (for the 11.0.x branch). Both releases were published on June 24, 2026, and are designated as security releases with upgrade strongly recommended. No configuration-based workaround is documented; upgrading to a patched version is the only recommended remediation. Administrators should also review GLPI user permissions and audit notification queue access logs as a precautionary measure (GLPI Release 10.0.26, GLPI Release 11.0.8).

The vulnerability was disclosed via GitHub Security Advisories by GLPI maintainer cedric-anne and credited to researcher Shad0wMazt3r. The GLPI project forum posted a notification thread about the release. Community reaction on the GLPI GitHub releases page was generally positive regarding the security release, with multiple users reacting favorably to the 11.0.8 release that bundled fixes for 16 security issues including this one. No significant independent security researcher commentary or major media coverage has been identified (GLPI Release 11.0.8, GitHub Advisory).