A privilege management flaw in GLPI allows authenticated, non-administrative users to manipulate rules execution, posing a significant risk to service desk integrity.

This vulnerability is categorized as improper privilege management (CWE-269). It allows an authenticated user, who lacks administrative permissions, to alter the order in which internal rules are executed within the platform.

The ability for a standard user to modify rule execution order can lead to unauthorized changes in ITIL workflows, license tracking, or software auditing processes. Given the CVSS score of 7.5, this high-severity vulnerability could be leveraged to bypass security controls or manipulate service desk outcomes, resulting in potential data integrity loss or administrative process subversion.

Immediate Action: Upgrade your GLPI installation to version 10.0.19 or later to incorporate the vendor-provided patch.

Proactive Monitoring: Audit logs for unusual administrative activity or modifications to rule configurations initiated by non-administrative user accounts.

Compensating Controls: Restrict access to the instance to trusted internal networks and implement strict role-based access control (RBAC) to limit the capabilities of standard users until the patch is applied.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing GLPI for IT asset management should prioritize this update due to the risk of workflow manipulation. While exploitation requires an existing user account, the potential for unauthorized rule changes necessitates immediate remediation to maintain the integrity of service desk and auditing operations.