This vulnerability in glpi-project glpi affects versions 11.0.5 through 11.0.7. It involves the Document::canViewFile function in the Document Handler component, where improper handling of the docid argument allows an attacker to bypass authorization controls remotely. The attack complexity is high, indicating that exploitation is not straightforward. The vendor was notified early, but no patch or official remediation level is currently available. The CVSS 4.0 base score is 6.3, reflecting a medium severity with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation allows an attacker to bypass authorization checks and potentially access documents they should not be able to view. This could lead to unauthorized disclosure of sensitive information. However, the high complexity of the attack reduces the likelihood of exploitation in practice. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor vendor communications for updates. Until a patch is available, restrict access to the affected versions and consider additional access controls around document handling if feasible.