Impact

Any user having access to standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...).

Patches

Upgrade to 10.0.6.

For more information

If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org.