GLPI exposure depends on active profiles and entity boundaries
GLPI combines IT service management, asset inventory, user support, contracts, licenses, and helpdesk workflows. A single GLPI instance can serve multiple departments or organizations through entities. An exposed deployment needs a review of active profiles, entity scope, authentication, and the data visible through public or self-service paths.
A count-only ZoomEye query on 2026-11-02 returned 3,776 assets for app="GLPI". The query used sub_type=all, page 1, and page size 1. The count describes matching product assets in the scan data. It does not prove that a helpdesk, inventory, or administrative path is exposed.
The ZoomEye query is a starting population. Ownership must be confirmed before testing.
Review active profile and entity together
GLPI documentation describes profiles with different permissions and entities that can isolate hierarchically organized groups within one installation. A user can have more than one profile and more than one entity assignment. The effective authority is the combination of the active profile and the active entity, not either setting alone.
Inventory accounts by identity source, assigned profiles, entity scope, and last access. Review administrators, supervisors, technicians, hotliners, observers, and self-service users. Confirm that a technician for one entity cannot change another entity's assets or tickets. Test the active-entity switch with an authorized account and verify that every list, search, export, and API path honors the same scope.
Review the self-service interface separately. A public helpdesk form can be useful, but it may reveal ticket numbers, user names, asset details, or knowledge-base content. Test whether an unauthenticated or low-privilege user can search for another person's ticket. Check file attachments and email notification templates for data that crosses an entity boundary.
Audit authentication and integration paths
GLPI can connect to local accounts and directory services such as Active Directory. Map directory groups to GLPI profiles explicitly. Do not let a broad directory group grant a powerful profile to every employee. Test group changes and deprovisioning so that a disabled account loses inventory and ticket access.
Inventory API clients, plugins, inventory agents, mail receivers, and notification integrations. Each may use a separate credential and hold a different authority. Remove old integration credentials and rotate them after an administrator leaves. A mail-to-ticket receiver should not be able to create an administrator account or change entity configuration.
Keep plugins and other extensions under a separate review. A plugin may add web routes, scheduled jobs, or database access. Record its version, source, owner, and required permissions. Remove a plugin when it is no longer maintained or when its functionality is no longer needed.
Inspect the public deployment
For each observed host, record hostname, certificate, IP address, product evidence, first-seen time, organization, and visible version if disclosed. Determine whether it is a production GLPI, a demo, or an unrelated page. Check TLS, login, and self-service paths through authorized observation without attempting credential guessing.
Compare DNS and certificate names with the current inventory. A legacy helpdesk host may still expose an old database, attachment directory, or plugin endpoint. Check reverse-proxy rules and trusted headers. A proxy that forwards an arbitrary user or entity header can let a client choose a different identity context.
Forward authentication, profile changes, entity changes, ticket access, inventory changes, and exports to an independent log store. Alert on new administrators, new API clients, broad profile assignments, and unusual bulk exports. Keep the logs long enough to investigate a ticket or asset disclosure.
Use the scan as a prioritization input
The 3,776 app matches can help find GLPI deployments, but a product fingerprint is not an ownership record. Match candidates to known domains and internal CMDB data. A host that appears in a scan without an owner or change record deserves investigation even if it is not vulnerable.
Repeat the count and retain the query time. A new host may indicate a regional deployment or a shadow instance. A disappearing host may indicate a migration. Neither change proves compromise.
GLPI's value comes from combining many operational records in one place. That concentration makes profile and entity boundaries the main review target. A well-run inventory records who can see each asset, ticket, and user, and proves that the answer remains correct after a role or directory change.
Top comments (0)