Improper access control in GLPI - CVE-2025-53113
Published: April 7, 2026
Vulnerability identifier: #VU125054
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-53113
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the external links feature when fetching information on items through external links. A remote privileged user can use the external links feature to access information on items they are not allowed to see to disclose sensitive information.
Affected software
GLPI
How to mitigate CVE-2025-53113
Install security update from vendor's website.
GLPI - update to 10.0.19