{"affected":[{"product":"glpi","source":"CNA: GitHub_M","vendor":"glpi-project","versions":[{"status":"affected","version":">= 0.85, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"cveId":"CVE-2026-57152","cwes":["CWE-862"],"description":"GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it. This issue is fixed in versions 10.0.26 and 11.0.8.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.1,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793834272297,"publishedAt":1793830855210,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-7v5q-w6f3-2v8p"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/glpi-project/glpi/commit/8a71d5800c48023cb8c6cb25c6f7fd2e1bce945c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/glpi-project/glpi/commit/dcabe7c78f4da0f3498ebfe77c177b1b3be6d6c6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/glpi-project/glpi/commit/8a71d5800c48023cb8c6cb25c6f7fd2e1bce945c"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/glpi-project/glpi/commit/dcabe7c78f4da0f3498ebfe77c177b1b3be6d6c6"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-7v5q-w6f3-2v8p"}],"remediation":[],"revision":"0591624ad028c94e12b56fb280a0b1e51b3950d8406d50f2372445e733c315c9","sources":[{"modifiedAt":1793830855210,"name":"CNA: GitHub_M","retrievedAt":1793833908665,"url":"https://www.cve.org/CVERecord?id=CVE-2026-57152"},{"modifiedAt":1793834272297,"name":"NVD","retrievedAt":1793838308739,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57152"}],"ssvc":null,"status":"published","title":"GLPI: Unallowed notifications sending","updatedAt":1793838308739}