GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticke…

CVE-2025-64516 affects GLPI, a free asset and IT management software package. The vulnerability allows unauthorized users to access GLPI documents attached to any item including tickets and assets. When the public FAQ feature is enabled, anonymous users can exploit this vulnerability to gain unauthorized access. The issue affects versions prior to 10.0.21 and 11.0.3. This represents a significant access control bypass that could lead to information disclosure. The vulnerability has been patched in versions 10.0.21 and 11.0.3.