CVE-2026-57152— GLPI: Unallowed notifications sending
Quick assessment
Affected
glpi-project glpi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GLPI 是一款免费的资产与 IT 管理软件套件。在 0.85 至 10.0.26 版本，以及 11.0.0 至 11.0.8 版本中，特定条件下，GLPI 的权限逻辑可能允许用户访问某个文档，而并未验证该文档是否确实关联到目标项目。这可能导致文件被无权查看的用户访问。该问题已在 10.0.26 和 11.0.8 版本中修复。
Possible ATT&CK Techniques 1 AI
T1086
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57152
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GLPI: Unallowed notifications sending
Source: CVE Program / CVE List V5
Vulnerability Description
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| glpi-project | glpi | >= 0.85, < 10.0.26 | - |
|
II. Public POCs for CVE-2026-57152
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57152
请登录查看更多情报信息。
Vendor Pages for CVE-2026-57152 (2)
-
-
🔗 Release 10.0.26 · glpi-project/glpi · GitHub x_refsource_MISC
Other References for CVE-2026-57152 (3)
-
https://github.com/glpi-project/glpi/security/advisories/GHSA-7v5q-w6f3-2v8p x_refsource_CONFIRM
Same Patch Batch · glpi-project · 2026-11-04 · 4 CVEs total
| CVE-2026-52848 | 9.2 CRITICAL | GLPI: MFA bypass |
| CVE-2026-47678 | 8.7 HIGH | GLPI: Blind Time based SQLI in dropdowns |
| CVE-2026-53631 | 5.3 MEDIUM | GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds |
IV. Related Vulnerabilities
Same product: glpi
-
CVE-2026-53631
GLPI: Unauthorized visibility expansion of knowbase items, r -
CVE-2026-47678
GLPI: Blind Time based SQLI in dropdowns -
CVE-2026-52848
GLPI: MFA bypass -
CVE-2026-121559
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privile -
CVE-2026-108726
GLPI through 12.0.0 Missing Authorization via ajax/map.php
Same vendor: glpi-project
-
CVE-2026-53631
GLPI: Unauthorized visibility expansion of knowbase items, r -
CVE-2026-47678
GLPI: Blind Time based SQLI in dropdowns -
CVE-2026-52848
GLPI: MFA bypass -
CVE-2026-121559
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privile -
CVE-2026-108726
GLPI through 12.0.0 Missing Authorization via ajax/map.php
Same weakness: CWE-862
-
CVE-2026-69002
三星框架服务因缺少权限检查导致授权漏洞 -
CVE-2026-122320
Kyverno before 1.19.2 Cross-Namespace Resource Read via gene -
CVE-2026-122316
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via Names -
CVE-2026-122303
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwr -
CVE-2026-53631
GLPI: Unauthorized visibility expansion of knowbase items, r