CVE-2023-53943

GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint

MEDIUM 6.9EPSS 0.4%

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.

Affected: Glpi-Project · GLPI
CVSS v4.0 VULNCHECK: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.35% chance of exploitation in the next 30 days, 28th percentile
Published: 2025-12-18
Updated: 2026-04-07

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/51418

Security advisories

https://www.vulncheck.com/advisories/glpi-username-enumeration-vulnerability-via-lost-pas…
https://glpi-project.org/pt-br

References

CVE Record
NVD entry