CVE-2026-13490
LOWCVSS v3.1: 3.7
Source data as of:
At a glance
- Severity
- LOW
- CVSS
- 3.7 v3.1 · NVD
- EPSS
- EPSS not provided by FIRST.org for this CVE
- CISA KEV
- No
- Type
- Improper Authorization, Authorization Bypass (IDOR) · NVD CWE
- Attack conditions (CVSS vector)
- NetworkNo privilegesNo user interaction · Source: NVD Vector
- Published
- 2026-06-28 · Modified: 2026-06-28
- References
- Jump to references (4)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Reference https://vuldb.com/cve/CVE-2026-13490
- Reference https://vuldb.com/submit/838225
- Reference https://vuldb.com/vuln/374487
- Reference https://vuldb.com/vuln/374487/cti