An authenticated user who possesses the configuration READ permission can retrieve the details of a specific asset object in GLPI. This unauthorized disclosure of asset information compromises confidentiality of data that was not intended for that user’s access level. The weakness is a classic configuration privilege problem identified as CWE-862.

GLPI asset and IT management software versions from 0.78 up to, but not including, 10.0.25 and 11.0.7 are affected. Users running any of these versions are vulnerable until they upgrade to 10.0.25 or 11.0.7.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid user credentials with READ permission; thus the attack vector is through legitimate user accounts that may be compromised or over‑privileged. Once accessed, the attacker can read asset data that the user should not be able to see, potentially enabling further reconnaissance or data exfiltration.