GLPI’s newer API allows a user with minimal permissions to carry out update operations that are normally blocked through the graphical interface, creating a clear break in the intended permission model. The flaw resides in the API’s update flow, which fails to apply the same authorization checks required for web‑based updates. This means an attacker who can authenticate to the system—even with limited rights—can elevate their effect by changing records or settings beyond their allowed scope. The weakness is a classic permission error, labeled CWE-862, and compromises the integrity of the asset management data. The risk is that malicious actors could alter system configurations, delete records, or otherwise sabotage IT management processes without needing higher privileges.

glpi-project:glpi, versions 11.0.0 through 11.0.8 inclusive, are impacted. The vulnerability was fixed in release 11.0.8, so only installations still running 11.0.0‑11.0.8 or earlier are vulnerable.

The CVSS score of 6.0 classifies this vulnerability as medium severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified, yet the vulnerability is publicized and the exploit path is simple: authenticated HTTP requests to the API. It is not listed in the CISA KEV catalog, but the issue is confirmed and a patch exists. Attackers can use the API endpoints to perform unauthorized updates once they have authenticated, making the attack vector an authenticated API call. Accordingly, the overall risk is moderate, but the patch is strongly advised to eliminate the flaw.