CVE-2026-13490— glpi-project glpi Document document.send.php canViewFile authorization
Possible ATT&CK Techniques 1AI
T1199 · Trusted RelationshipAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| glpi-project | glpi | 11.0.5 | affected |
11.0.6 | affected | ||
11.0.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13490
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
glpi-project glpi Document document.send.php canViewFile authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
GLPI 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GLPI是法国GLPI组织开源的一款开源IT和资产管理软件。该软件提供功能全面的IT资源管理接口,你可以用它来建立数据库全面管理IT的电脑,显示器,服务器,打印机,网络设备,电话,甚至硒鼓和墨盒等。 GLPI 11.0.5版本、11.0.6版本和11.0.7版本存在授权问题漏洞，该漏洞源于Document Handler组件中front/document.send.php文件的Document::canViewFile函数对参数docid操作不当，导致授权绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| glpi-project | glpi | 11.0.5 | cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-13490
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13490
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: glpi
- CVE-2026-42321
GLPI has stored XSS in asset locks - CVE-2026-42320
GLPI vulnerable to arbitrary file access - CVE-2026-42318
GLPI Vulnerable to Arbitrary Item Deletion via Planning Endp - CVE-2026-42317
GLPI vulnerable to arbitrary files deletion by technician - CVE-2026-44281
GLPI vulnerable to unauthorized reading of a specific asset
Same vendor: glpi-project
- CVE-2026-42321
GLPI has stored XSS in asset locks - CVE-2026-42320
GLPI vulnerable to arbitrary file access - CVE-2026-42318
GLPI Vulnerable to Arbitrary Item Deletion via Planning Endp - CVE-2026-42317
GLPI vulnerable to arbitrary files deletion by technician - CVE-2026-44281
GLPI vulnerable to unauthorized reading of a specific asset
Same weakness: CWE-639
- CVE-2026-63178
Onyx Curator-scope IDOR: any curator can modify membership o - CVE-2026-75105
phpIPAM Temporary Subnet Share Information Disclosure via Ad - CVE-2026-75103
Crawlab Missing Authorization on Password Change Endpoint Al - CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in p - CVE-2026-74877
openssl_encrypt before 1.4.0 Missing Ownership Verification
V. Comments for CVE-2026-13490
No comments yet