CVE-2026-53631— GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

Quick assessment

Affected

glpi-project glpi

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GLPI 是一款免费的资产与 IT 管理软件套件。在 0.83 至 10.0.27 版本，以及 11.0.0 至 11.0.9 版本中，任何已认证用户均可提交精心构造的请求，修改知识库条目、提醒或 RSS 订阅的可见性，从而访问本应受限的内容。该问题已在 10.0.27 和 11.0.9 版本中修复。

CVSS 5.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

Source: CVE Program / CVE List V5

Vulnerability Description

GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. This issue is fixed in versions 10.0.27 and 11.0.9.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
glpi-project	glpi	>= 0.83, < 10.0.27	-

II. Public POCs for CVE-2026-53631

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-53631

请登录查看更多情报信息。

Other References for CVE-2026-53631 (5)

https://github.com/glpi-project/glpi/releases/tag/11.0.9 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/10.0.27 x_refsource_MISC
https://github.com/glpi-project/glpi/security/advisories/GHSA-5qgv-9jcx-wph7 x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/89ed992a44be28f24881e19678b38f9fd3fa4309 x_refsource_MISC
https://github.com/glpi-project/glpi/commit/6482e735e2a98b03927b0cb35f47bf81230ad35a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-53631

Same Patch Batch · glpi-project · 2026-11-04 · 4 CVEs total

CVE-2026-52848	9.2 CRITICAL	GLPI: MFA bypass
CVE-2026-47678	8.7 HIGH	GLPI: Blind Time based SQLI in dropdowns
CVE-2026-57152	7.1 HIGH	GLPI: Unallowed notifications sending

IV. Related Vulnerabilities

Same product: glpi

Same vendor: glpi-project

Same weakness: CWE-862