A critical authorization bypass vulnerability in GLPI allows unauthenticated attackers to gain unauthorized access to sensitive internal documents, posing a significant risk of data exposure.

The software suffers from an improper access control flaw, specifically an authorization bypass through user-controlled keys, which permits unauthenticated users to retrieve restricted attachments if the public FAQ feature is enabled.

The ability for unauthorized or anonymous actors to access sensitive internal documentation, such as asset information or support ticket details, presents a substantial risk of data breach and intellectual property loss. Given the CVSS score of 7.5, this high-severity vulnerability could lead to the exposure of confidential technical configurations or sensitive user data, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Upgrade to GLPI version 10.0.21 or 11.0.3 immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Audit access logs for unusual or high-volume document requests, particularly those originating from unauthenticated sources or external IP addresses.

Compensating Controls: If patching is not immediately feasible, disable the public FAQ feature to restrict the attack vector, and implement strict egress filtering or WAF rules to block unauthorized access to the document storage directory.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

Given the ease of exploitability and the potential for unauthorized data exfiltration, organizations should prioritize the deployment of the provided security updates. Administrators must ensure that the patch is applied across all instances, specifically those where public-facing features like the FAQ are enabled, to prevent potential information disclosure.