GLPI versions 11.0.5 through 11.0.8 contain a flaw in permission logic that allows a user to read documents linked to items they are not authorized to view by exploiting a missing validation that the document is actually associated with the target item. The result is an unintended disclosure of confidential documents and a breach of the system's confidentiality, corresponding to the authorization bypass weaknesses identified as CWE-639 and CWE-862.

The vulnerability affects the GLPI asset and IT management software produced by the glpi-project, specifically all releases from 11.0.5 up to and including 11.0.8, until the issue is addressed by the 11.0.8 release.

The flaw carries a CVSS score of 7.1, indicating significant severity, but the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The most likely exploitation scenario involves an authenticated user who accesses the web interface over the network and supplies a legitimate item identifier to retrieve a document that should be inaccessible; thus, the attack vector is remote and requires only standard user privileges.