CVE-2025-53105CWE-269

GLPI permits unauthorized rules execution order

High · published August 27, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-08-27T14:40Z
EPSS history
Timeline
  • 27 AUG 14:40Z
    GLPI permits unauthorized rules execution order
    cvelistv5