CVE-2025-64516

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

• CWE-284
• CWE-639

• https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3cPatch
• https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27Patch
• https://github.com/glpi-project/glpi/releases/tag/10.0.21Release Notes
• https://github.com/glpi-project/glpi/releases/tag/11.0.3Release Notes
• https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46Vendor Advisory

Published

Jan 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64509Bugsink is a self-hosted error tracking tool. In versions pr…7.5
• CVE-2025-6451A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64511MaxKB is an open-source AI assistant for enterprise. In vers…8.8
• CVE-2025-64512Pdfminer.six is a community maintained fork of the original …7.8
• CVE-2025-64513Milvus is an open-source vector database built for generativ…9.3
• CVE-2025-64515Open Forms allows users create and publish smart forms. Prio…4.3
• CVE-2025-64517sudo-rs is a memory safe implementation of sudo and su writt…4.4
• CVE-2025-64518The CycloneDX core module provides a model representation of…7.5
• CVE-2025-64519TorrentPier is an open source BitTorrent Public/Private trac…8.8
• CVE-2025-6452A vulnerability was found in CodeAstro Patient Record Manage…4.8
• CVE-2025-64520GLPI is a free asset and IT management software package. Sta…4.3
• CVE-2025-64521authentik is an open-source Identity Provider. Prior to vers…4.8