CVE-2024-37147

What it actually does

An authenticated user can attach a document to any item without possessing write access on the target item due to missing authorization enforcement on attachment operations.

Why it matters to the business

Allows unauthorized modification of IT asset records, which can compromise data integrity, enable tampering with audit trails, or support further unauthorized actions in asset and service management workflows; urgency is low given absence from KEV and stable low EPSS.

How an attack unfolds

An attacker authenticates with a low-privileged account, identifies target items via enumeration, and submits attachment requests that bypass permission checks to link documents to items they cannot otherwise modify.

How to fix it

Upgrade glpi-project/glpi to the fixed version containing commit 683393a84eeff1e165fa0f9f31067cc9add09b70 (equivalent to 10.0.16 or later).

How to confirm the fix worked

Confirm the deployed version includes the referenced commit or later; test that attachment attempts to items without write permission are now rejected for authenticated users.

Typical attack path

1. Obtain valid authenticated session
2. Enumerate or guess item identifiers
3. Craft and send attachment requests targeting arbitrary items
4. Verify document linkage without triggering write-access errors

How to detect it

Review application and web server logs for attachment API calls or form submissions where the acting user lacks documented write access on the referenced item; correlate with user permission matrices.

What your security team should do

• Apply the upgrade to the fixed commit or 10.0.16 release across all instances
• Audit recent document attachment logs for entries created by users lacking write rights on the target items
• Review and tighten document attachment permissions as a defense-in-depth measure