# CVE-2026-53631: GLPI authorization bypass in knowledge base visibility

Source: https://junglewise.ai/threats/cve-2026-53631-glpi-is-a-free-asset-and-it-management-software-package-from-0-83  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-53631 · Severity: info · Published 2026-11-04

GLPI is an open-source IT asset management platform used by organizations to track hardware, software, and IT services. An authenticated user could craft special requests to change the visibility settings of knowledge base articles, reminders, and RSS feeds, allowing them to access sensitive information that should be restricted to specific users or groups.

Technologies: [GLPI Project GLPI](https://junglewise.ai/threats/technologies/glpi-project-glpi). Vendors: [GLPI Project](https://junglewise.ai/threats/vendors/glpi-project).

## Quick answers

**Is CVE-2026-53631 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53631 being exploited in the wild.

**How severe is CVE-2026-53631?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** GLPI Project GLPI 0.83 to 10.0.26; 11.0.0 to 11.0.8.

**Is there a fix for CVE-2026-53631?** Yes: fixed in 10.0.27, 11.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53631 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-53631?** Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.27, 11.0.9

## Technical details

An authorization bypass vulnerability exists in GLPI's permission checks for visibility criteria on knowledge base items, reminders, and RSS feeds. Authenticated users could submit crafted POST requests to modify visibility settings without proper authorization validation. The fix adds explicit permission checks (CREATE validation) in the form handlers before applying visibility changes.

## Affected products

- GLPI Project GLPI 0.83 to 10.0.26; 11.0.0 to 11.0.8

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/glpi-project/glpi/commit/6482e735e2a98b03927b0cb35f47bf81230ad35a](https://github.com/glpi-project/glpi/commit/6482e735e2a98b03927b0cb35f47bf81230ad35a)
- [https://github.com/glpi-project/glpi/commit/89ed992a44be28f24881e19678b38f9fd3fa4309](https://github.com/glpi-project/glpi/commit/89ed992a44be28f24881e19678b38f9fd3fa4309)

## Related threats

- [GLPI authorization bypass in document access](https://junglewise.ai/threats/cve-2026-57152-glpi-is-a-free-asset-and-it-management-software-package-from-0-85)
- [GLPI 2FA bypass in login via crafted URL](https://junglewise.ai/threats/cve-2026-52848-glpi-is-a-free-asset-and-it-management-software-package-from-11-0)
- [GLPI SQL injection in dropdown values endpoint](https://junglewise.ai/threats/cve-2026-47678-glpi-is-a-free-asset-and-it-management-software-package-from-9-4)
- [GLPI privilege escalation in account cloning](https://junglewise.ai/threats/cve-2026-121559-glpi-10-0-0-before-10-0-28-and-11-0-0-before-11-0-10-contains-a)
- [GLPI missing authorization in ajax/map.php](https://junglewise.ai/threats/cve-2026-108726-glpi-through-12-0-0-contains-a-missing-authorization)