Able to read any token through API user endpoint in GLPI

published 2020-05-05 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3418

cvss: 6.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

Patch / fix

fixed in 1

glpi-project glpi 9.4.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-11033 updated 2025-11-21 cvss 6.6

glpi: any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
NVD	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected products

glpi-project GLPI

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

CVE List CVE-2020-11033
NVD CVE-2020-11033

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary