GLPI Unauthorized Document Access Vulnerability

A vulnerability in GLPI prior to versions 10.0.21 and 11.0.3 allows unauthorized users to access documents attached to any item, such as tickets or assets. This issue can be exploited by anonymous users if the public FAQ feature is enabled.

Impact

Exploitation of this vulnerability allows unauthorized access to documents, which could lead to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, an unauthorized user can request documents attached to items through the GLPI interface. If the public FAQ is enabled, this can be done anonymously. In versions prior to 10.0.21 and 11.0.3, the document access control did not properly restrict visibility based on user permissions or item associations.

Remediation

Users are advised to upgrade to GLPI versions 10.0.21 or 11.0.3.