Rafaelczanett

**Name of the Vulnerable Software and Affected Versions** glpi-project glpi versions 11.0.5 through 11.0.7 **Description** An authorization bypass exists in the Document Handler component within the file 'front/document.send.php'. The issue occurs in the `Document::canViewFile()` function when processing the `docid` parameter. This flaw allows a remote attacker to bypass authorization checks, although the attack is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `docid` parameter in the 'front/document.send.php' file to minimize the risk of exploitation.