CVE-2026-32312CWE-862

GLPI: Unauthorized export of form structure

Medium · published May 18, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-18T23:46Z
EPSS history
Timeline
  • 18 MAY 23:46Z
    GLPI: Unauthorized export of form structure
    cvelistv5