GLPI allows users with low privileges who can access the planning page to delete any object in the system. The vulnerability is an authorization bypass that removes the integrity of stored data, enabling an attacker to permanently delete tickets, assets, or other entities. This flaw can erode trust in the IT asset management platform and disrupt ongoing operations. The weakness is classified as CWE‑862, indicating a failure to enforce proper access control.

All GLPI installations from version 9.5.0 up to and including 10.0.24, and from 11.0.0 up to and including 11.0.6 are affected. Users running earlier releases are not impacted. The problem is confined to the web application and does not require special network privileges beyond normal HTML form access.

The CVSS score of 7.0 categorizes the flaw as high severity. Though the EPSS score is not available, the flaw’s presence in an open‑source product and its clear path through the UI suggest a realistic chance of exploitation. It is not listed in the CISA KEV catalog. An attacker would likely exploit the vulnerability via a legitimate browser session, submitting deletion requests through the planning endpoint without needing higher privileges. No special environment prerequisites are required beyond administrative access to the planning interface.