CVE-2025-64520 - GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API

Back Back to CVE browser

MEDIUM

GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API

Published Dec 16, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.22%

Description

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

Affected products

Vendor Glpi-Project Product Glpi Default
n/a
- Version
  >= 9.1.0, < 10.0.21
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glpi-Project

Glpi

n/a

Version	Status	Constraints
>= 9.1.0, < 10.0.21	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3
x_refsource_MISCPatch
https://github.com/glpi-project/glpi/security/advisories/GHSA-62p9-prpq-j62q
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3		x_refsource_MISCPatch
https://github.com/glpi-project/glpi/security/advisories/GHSA-62p9-prpq-j62q		x_refsource_CONFIRMVendor Advisory