CVE-2023-53943 MEDIUM

CVE-2023-53943: GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint

Vendor Glpi-Project
Product GLPI
Weakness CWE-203
Published December 18, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
April 7, 2026 Record updated