CVE-2025-64520

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64520
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64520.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64520
Aliases
  • GHSA-62p9-prpq-j62q
Downstream
Published
2025-12-16T21:59:02.772Z
Modified
2026-03-14T12:44:32.193359Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API
Details

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64520.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a3d5cc4a63ae592c0b5592ebe6d562164904dab3

Affected versions

0.*
0.90
0.90-RC1
0.90-RC2
0.90-beta1
0.90-beta2
0.90.1
10.*
10.0.0
10.0.0-beta
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
10.0.1
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.17
10.0.18
10.0.19
10.0.2
10.0.20
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
9.*
9.1
9.1-RC1
9.1-RC2
9.3-beta
9.4.0
9.4.0-beta
9.4.0-rc1
9.4.0-rc2
9.4.1
9.4.1.1
9.4.2
9.4.3
9.4.4
9.4.5
9.4.6
9.5.0
9.5.0-rc1
9.5.0-rc2
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.5.6
9.5.7

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "9.1.0"
            },
            {
                "fixed": "10.0.21"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64520.json"