PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13490 glpi-project CVE debrief

CVE-2026-13490 is an authorization bypass vulnerability in the Document Handler component of glpi-project glpi versions 11.0.5, 11.0.6, and 11.0.7. The vulnerability exists in the `Document::canViewFile` function within the `front/document.send.php` file. An attacker can exploit this vulnerability remotely, but the attack has high complexity and is difficult to exploit. The vendor, glpi-project, was contacted early about this disclosure.

Vendor
glpi-project
Product
glpi
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-28
Original CVE updated
2026-06-28
Advisory published
2026-06-28
Advisory updated
2026-06-28

Who should care

Security teams responsible for glpi-project glpi installations, particularly those using versions 11.0.5, 11.0.6, and 11.0.7, should be aware of this vulnerability. Given the MEDIUM CVSS score of 6.3, organizations should prioritize patching to prevent potential authorization bypass attacks. This vulnerability's high complexity and difficult exploitability may temporarily reduce immediate risk, but defenders should remain vigilant.

Technical summary

CVE-2026-13490 is a MEDIUM-severity vulnerability (CVSS score 6.3) affecting glpi-project glpi versions 11.0.5, 11.0.6, and 11.0.7. It is an authorization bypass vulnerability in the Document Handler component, specifically in the `Document::canViewFile` function of `front/document.send.php`. The vulnerability allows for remote exploitation but has high complexity and is difficult to exploit. The Common Weakness Enumeration (CWE) for this vulnerability includes CWE-285 and CWE-639.

Defensive priority

Apply patches for glpi-project glpi versions 11.0.5, 11.0.6, and 11.0.7 immediately. Given the remote exploitation and MEDIUM severity, prioritize patching to prevent potential authorization bypass attacks.

Recommended defensive actions

  • Apply patches for glpi-project glpi versions 11.0.5, 11.0.6, and 11.0.7
  • Review and update access controls for the Document Handler component
  • Monitor for suspicious activity related to document access
  • Verify and enforce proper authorization for document viewing
  • Consider implementing compensating controls for sensitive documents

Evidence notes

The CVE-2026-13490 entry was obtained from the National Vulnerability Database (NVD) and has a single source reference from Vuldb. The CVE was published and modified on 2026-06-28T12:17:03.350Z. The CVSS score is 6.3, indicating a MEDIUM severity vulnerability. The vulnerability affects glpi-project glpi versions 11.0.5, 11.0.6, and 11.0.7.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.