GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint
Priority HIGH 70CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.
Summary
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| glpi-project | GLPI | 9.5.7 | — | No fix listed | CNA |
- GLPI Vendorglpi-project Affected 9.5.7 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:glpi-project:glpi:9.5.7:*:*:*:*:*:*:* | 9.5.7 | Vulnerable | glpi-project |
- cpe:2.3:a:glpi-project:glpi:9.5.7:*:*:*:*:*:*:* Versions 9.5.7 Vulnerable ·glpi-project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53943
- 2026-10-03 Alias added: GHSA-5w2x-g68p-qvmf
References
Exploit 1
Other 1
More glpi-project Glpi vulnerabilities
- TI-2022-16341 /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18516 GLPI allows unauthenticated SQL injection through the inventory endpoint CVSS 3.1CRITICAL 9.8
- TI-2023-25210 GLPI SQL injection through inventory agent request CVSS 3.1CRITICAL 9.8
- TI-2023-17986 GLPI vulnerable to SQL injection via inventory agent request CVSS 3.1CRITICAL 9.8
- TI-2022-13106 SQL injection on login page in GLPI CVSS 3.1CRITICAL 9.8
- TI-2023-18602 GLPI vulnerable to SQL injection through Computer Virtual Machine information CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-53943 · CVE Program
- CVE-2023-53943 · NVD
- FIRST EPSS
- GHSA-5w2x-g68p-qvmf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences