The GLPI software allows an authenticated user to enable debug mode during profile updates, yet the system fails to enforce the intended privilege boundary, permitting users without the proper permission to activate debug mode. This behavior results in privilege escalation, granting the attacker access to sensitive system information that can aid further attacks. The vulnerability corresponds to CWE‑269, Improper Privilege Management.

Affected products are the GLPI asset and IT management package from the GLPI Project, spanning all releases from version 0.72 through 10.0.26 and the 11.0.8 release. The issue was present in the GitHub commits cited in the advisory and has been resolved in the 10.0.26 and 11.0.8 releases.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is not available, suggesting the exploitation likelihood has not been quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated session; the attack occurs via the normal profile update interface and does not demand remote access or network exploitation. Once debug mode is enabled, an attacker may view logs, configuration data, and other privileged information, potentially enabling additional attacks. Thus, the risk is moderate, but the impact of unauthorized debug mode activation can provide significant footholds for adversaries.