Arbitrary document read via unrelated form authorization
Published Jun 28, 2026 · Updated Jun 28, 2026
Authorization bypass in GLPI 11.0.5 through 11.0.7 allows attackers to read arbitrary documents through the document download handler. Document::canViewFile accepts attacker-controlled form identifiers and checks only whether the session can answer that form, not whether the requested document belongs to it. Access requires permission to answer an active form, or an anonymous session for a direct-access form, plus a known or guessed document ID.
Summary
What happened
Authorization bypass in GLPI 11.0.5 through 11.0.7 allows attackers to read arbitrary documents through the document download handler. Document::canViewFile accepts attacker-controlled form identifiers and checks only whether the session can answer that form, not whether the requested document belongs to it. Access requires permission to answer an active form, or an anonymous session for a direct-access form, plus a known or guessed document ID.
The record
- CVE
- CVE-2026-13490
- Published
- Jun 28, 2026
- Updated
- Jun 28, 2026
- Vendor
- GLPI Project
- Product
- GLPI
- Classifications
- CWE-639, CWE-285, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jun 28, 2026CVE publishedPublication date reported by the CVE source.
- Jun 28, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=11.0.5
- Affected versionversion=11.0.6
- Affected versionversion=11.0.7
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- VulDB submission 838225 reproduction requestproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo