The GLPI asset and IT management system contains a flaw that allows authenticated users with minimal privileges to create, update, or delete comments and translation entries on knowledge‑base items. This bypasses the intended authorization controls, letting the user alter or remove protected content. The missing authorization is identified as CWE‑285, meaning the application fails to enforce proper permission checks for these operations.

GLPI versions 0.85 through 10.0.26 and the 11.0.8 release are affected. Any installation running one of those releases with standard user accounts can be leveraged to abuse the comment or translation controls.

With a CVSS score of 5.3 the flaw is of moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Since only basic user credentials are required, the primary attack vector is an authenticated connection to the application. An attacker can therefore compromise the integrity of knowledge‑base content without additional privileges, potentially spreading misinformation or eroding trust in the knowledge base.