The vulnerability allows an authenticated user with Read permission on forms to export the structure of any form, even those they are not authorized to view. This unintended disclosure of form metadata could reveal configuration details, field names, and relationships that are considered sensitive. The weakness is an access control flaw, identified as CWE‑862.

GLPI – a free asset and IT management software – is affected in releases 11.0.0 through 11.0.6. The GLPI Project states the issue is fixed in version 11.0.7. Administrators should verify whether their deployment falls within the vulnerable range and plan an update accordingly.

With a CVSS score of 5.1 the vulnerability is considered moderate. No EPSS score is available and it is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. Attackers must be authenticated with Read rights, a condition that can be met by a legitimate user; the exploitation path simply uses the export interface to retrieve unauthorized form definitions.