CVE-2025-64520CWE-862broken-access-control

CVE-2025-64520

Medium · published December 17, 2025

CVSS v3.1

6.5

EPSS

Percentile

11.4

In the wild

Unconfirmed

What it is

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00216 · 11.4th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2025-12-17T03:15Z

Affected products (1)

Product	Versions	Fixed in
glpi-project/glpi	≥ 9.1.0, < 10.0.21	10.0.21

References (2)

https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3 · [email protected]https://github.com/glpi-project/glpi/security/advisories/GHSA-62p9-prpq-j62q · [email protected]

EPSS history

Timeline

16 DEC 21:59Z
GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API
cvelistv5