Is CVE-2026-57152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57152 being exploited in the wild.

How severe is CVE-2026-57152?

Informational severity, published 4 November 2026.

Which products and versions are affected?

GLPI Project GLPI 0.85 through 10.0.25, 11.0.0 through 11.0.7.

Is there a fix for CVE-2026-57152?

Yes: fixed in 10.0.26, 11.0.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57152 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57152?

Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57152: GLPI authorization bypass in document access

CVE-2026-57152 · Severity: info · Published 2026-11-04

GLPI is a free asset and IT management software used to track company equipment and IT resources. Due to a flaw in its permission checking logic, users could gain access to documents they should not be able to view by bypassing verification that the document is linked to the item they are accessing. This could result in unauthorized disclosure of sensitive files.

Technologies: GLPI Project GLPI. Vendors: GLPI Project.

Quick answers

Is CVE-2026-57152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57152 being exploited in the wild.
How severe is CVE-2026-57152?: Informational severity, published 4 November 2026.
Which products and versions are affected?: GLPI Project GLPI 0.85 through 10.0.25, 11.0.0 through 11.0.7.
Is there a fix for CVE-2026-57152?: Yes: fixed in 10.0.26, 11.0.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57152 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57152?: Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.0.26, 11.0.8

Technical details

The vulnerability exists in GLPI's permission logic where document access control fails to confirm that a document is properly linked to the targeted item before granting access. An authenticated attacker can exploit this authorization bypass to access files without proper entitlement. The issue was fixed by removing overly permissive access logic in the QueuedNotification component.

Affected products

GLPI Project GLPI 0.85 through 10.0.25, 11.0.0 through 11.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.