CVE-2026-13490: GLPI Document Authorization Bypass Vulnerability

Technical summary

CVE-2026-13490 is an authorization bypass vulnerability in the Document::canViewFile function located in front/document.send.php within GLPI's Document Handler component. The vulnerability stems from improper validation of the docid parameter, allowing attackers to manipulate document requests to circumvent access control checks. The attack vector is network-based, requires no user interaction, but has high attack complexity and does not require authentication. The vulnerability maps to CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key), indicating a flaw in how the application validates permissions before serving document content.

Business impact

Organizations running GLPI for IT asset management and ticketing may face exposure of confidential documents, including internal policies, vendor contracts, or IT infrastructure details that should be restricted. The practical risk is moderated by the high attack complexity required to exploit the vulnerability. However, in multi-tenant or sensitive environments where document segregation is critical, unauthorized file access could lead to information disclosure incidents, compliance violations, or competitive intelligence loss. Most organizations should address this through patching but may deprioritize it against critical infrastructure vulnerabilities.

Affected systems

The vulnerability specifically affects GLPI versions 11.0.5, 11.0.6, and 11.0.7. Organizations running these versions of GLPI should verify their deployment version and plan patching accordingly. Earlier or later versions may not be vulnerable; consult the vendor advisory to confirm the full scope of affected releases. GLPI is commonly deployed in mid-market and enterprise IT departments as a self-hosted solution, so exposure is primarily limited to organizations that have explicitly deployed this software.

Exploitability

The CVSS 3.1 score of 3.7 (LOW severity) reflects that while the vulnerability is remotely exploitable without authentication, it carries high attack complexity and yields only limited confidentiality impact. The vendor assessment indicates exploitability is difficult, meaning an attacker would need specific knowledge of document IDs and system architecture to successfully craft a request. This is not a trivial or obvious exploit; it requires reconnaissance and careful manipulation of parameters. No public exploit code or proof-of-concept is known to be circulating, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Organizations running affected GLPI versions should apply the security patch provided by the vendor. The patch should address the authorization validation logic in the Document::canViewFile function to ensure that all file access requests are properly authenticated and authorized. Additionally, conduct an audit of document access logs within your GLPI instance to identify whether any unauthorized document access occurred during the window of vulnerability. Apply the patch during a maintenance window and verify document access controls afterward.

Patch guidance

Contact GLPI support or check the official GLPI security advisories to obtain the patched version for your deployment. Verify against the vendor advisory to confirm which versions contain the fix, as the source data does not specify the patched version number. Test the patch in a non-production environment first to ensure compatibility with any custom configurations or integrations. Plan the upgrade to coincide with your change management schedule, as GLPI patching may require brief downtime depending on your deployment architecture.

Detection guidance

Monitor GLPI access logs for unusual document.send.php requests with varying or suspicious docid parameters, particularly from unauthenticated sessions or unexpected IP ranges. Look for patterns of sequential or randomized docid values that suggest parameter enumeration. Implement request logging at the web server level to capture all document retrieval attempts. Consider deploying a Web Application Firewall (WAF) rule to restrict document.send.php access to authenticated users and to block requests with suspicious docid patterns. Periodically review file access audit logs within GLPI to detect anomalies in document access patterns.

Why prioritize this

While this vulnerability has a low CVSS score and difficult exploitability, it should still be prioritized for patching because: (1) it affects a specific, identifiable software version; (2) the vendor was engaged early and patches are likely available; (3) document confidentiality is often business-critical in IT environments; and (4) the fix is relatively contained. However, organizations should not treat this as an emergency—patch it within your normal monthly or quarterly security cycle, prioritizing higher-severity vulnerabilities first.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects a low-severity vulnerability because the attack requires high complexity, yields only limited confidentiality impact (no integrity or availability impact), and affects a narrow audience of GLPI deployments. The score appropriately captures that while the vulnerability is real and should be addressed, it does not pose an immediate critical threat. Organizations with strong compensating controls (such as network segmentation or WAF policies) or with non-sensitive documents in GLPI may accept slightly longer remediation timelines.

Frequently asked questions