GLPI versions 11.0.0 to 11.0.6 contain a missing authorization vulnerability (CWE-862) where an authenticated user possessing forms READ permission can export the structure of forms without proper authorization. This allows access to unauthorized form data structures. The issue was resolved in GLPI version 11.0.7. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low complexity, and no user interaction required.

An authenticated user with forms READ permission can access and export the structure of forms they are not authorized to view. This could lead to unauthorized disclosure of form structure information within the GLPI asset and IT management software. There is no indication of privilege escalation, code execution, or data modification. No known exploits are reported in the wild.

Upgrade GLPI to version 11.0.7 or later, where this missing authorization vulnerability has been fixed. Since the vendor advisory confirms the issue is resolved in 11.0.7, applying this official fix is the recommended remediation. No other mitigation steps are indicated.