The vulnerability exists in the Document::canViewFile function of the document.send.php handler in GLPI. By manipulating the docid argument, an attacker can bypass the intended permission check and access files that should be protected. The flaw allows remote exploitation, meaning an attacker could conduct the attack from outside the local network. Although the attack is described as having high complexity and difficult exploitability, it nevertheless permits unauthorized viewing of confidential documents, compromising data confidentiality.

GLPI versions 11.0.5, 11.0.6, and 11.0.7 are affected. These releases use the Document Handler component to serve files, and the authorization logic flaw impacts users trying to view protected documents. The vulnerability is specific to the GLPI product from the glpi-project vendor.

The CVSS score of 6.3 places the vulnerability in the medium severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited. The attack requires remote access and manipulation of a file identifier, with a high complexity but difficult exploitation path. Consequently, while the risk is moderate, the confidentiality impact warrants timely remediation.