CVE-2023-53943
GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint
- State
- Published
- Severity
- 6.9 Medium
- Published
- Dec 18, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 16, 2025
Description
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-203 Observable Discrepancy
Affected Products
| Product | Versions |
|---|---|
GLPIGlpi-Project |
|
References
- ExploitDB-51418exploit
- Official Product Homepageproduct
- VulnCheck Advisory: GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.