Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M

CVE-2025-64516GLPI incorrectly authorizes access to documents

High 7.5

In plain English

A high-severity improper access control in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 10.0.0, < 10.0.21>= 11.0.0, < 11.0.3

Weakness: CWE-284, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46 x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c x_refsource_MISC
https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/10.0.21 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/11.0.3 x_refsource_MISC