CVE-2026-13490

Name of the Vulnerable Software and Affected Versions glpi-project glpi versions 11.0.5 through 11.0.7

Description An authorization bypass exists in the Document Handler component within the file 'front/document.send.php'. The issue occurs in the Document::canViewFile() function when processing the docid parameter. This flaw allows a remote attacker to bypass authorization checks, although the attack is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the docid parameter in the 'front/document.send.php' file to minimize the risk of exploitation.