Vulnerability · Published Jun 28, 2026 · Assigned by VulDB

CVE-2026-13490glpi-project glpi Document document.send.php canViewFile authorization

Low 3.7

In plain English

A low-severity authorization bypass via user-controlled key in glpi from glpi-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	11.0.511.0.611.0.7

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R

References

VDB-374487 | glpi-project glpi Document document.send.php canViewFile authorization vdb-entry, technical-description
VDB-374487 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-13490 | CVE Analysis and Report third-party-advisory
Submit #838225 | glpi-project glpi 11.0.5 - 11.0.7 Authorization Bypass third-party-advisory