This vulnerability in glpi-project glpi (versions 11.0.5, 11.0.6, and 11.0.7) involves an authorization bypass in the Document Handler component, specifically in the Document::canViewFile function within front/document.send.php. By manipulating the docid parameter, an attacker can bypass authorization controls remotely. The attack complexity is high, indicating that exploitation requires significant effort or conditions. The vendor was contacted early, but no official fix or remediation level has been published as of now.

Successful exploitation allows remote attackers to bypass authorization checks and potentially access documents they should not be able to view. The vulnerability does not require privileges or user interaction but has high complexity, reducing the likelihood of widespread exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Due to the high complexity of exploitation, immediate urgent action may not be necessary, but cautious handling of document access controls is advised.