CVE-2026-53631
Severity not reportedData quality: partial.
Some fields were not provided by the source.
GLPI is a free asset and IT management software package.
GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. This issue is fixed in versions 10.0.27 and 11.0.9.
CVSS
—
Not reported by the source
Timeline (UTC)
Published: 2026-11-04 23:17
Modified: 2026-11-04 23:17
NVD status: Deferred
Last synced 1 hour ago
Verified against the source API 2026-11-04 23:38 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/glpi-project/glpi/commit/6482e735e2a98b03927b0cb35f47bf81230ad35a security-advisories@github.com
- https://github.com/glpi-project/glpi/commit/89ed992a44be28f24881e19678b38f9fd3fa4309 security-advisories@github.com
- https://github.com/glpi-project/glpi/releases/tag/10.0.27 security-advisories@github.com
- https://github.com/glpi-project/glpi/releases/tag/11.0.9 security-advisories@github.com
- https://github.com/glpi-project/glpi/security/advisories/GHSA-5qgv-9jcx-wph7 security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-04 23:38 UTC · record ↗