[Bug]: 403 Forbidden when clicking "+" to add an item in Rack view (Item_Rack ID: -1 fails CREATE check in CommonDBRelation)

[zriver-z]

Code of Conduct

• I agree to follow this project's Code of Conduct

Disable plugins

• I reproduce the issue with all plugins disabled

Is there an existing issue for this?

• I have searched the existing issues

Version

11.0.9

Bug description

Prerequisites

• Can you reproduce the problem on a fresh install or the demo?
• Did you check if problems are already reported?
• Did you check the logs?

Description

When viewing a Rack in the DCIM module (under Assets -> Racks) and clicking on the + icon on any rack unit position to add a device, an HTTP 403 (Forbidden) response is returned, and the modal form fails to display with "You don't have permission to perform this action".

This happens even when logged in as super-admin with full rights on both Management (Data centers) and Assets (Computers, Servers, Network devices, etc.), and reproduces on both existing and newly-created completely empty racks.

Steps to reproduce

1. Log in with a Super-Admin profile.
2. Go to Assets -> Racks.
3. Open any rack (or create a brand new empty rack) and go to the Items (Graphical rack view) tab.
4. Click on the + sign on any U position (e.g., position 42).
5. Open browser DevTools Network tab: observe GET /front/item_rack.form.php?ajax=true&orientation=0&position=42&racks_id=X returning 403 Forbidden.

Relevant log output

From glpi/files/_log/access-errors.log (or Docker container stdout/stderr):

User ID: `2` tried to execute an invalid request on `/front/item_rack.form.php?ajax=true&orientation=0&position=42&racks_id=2`.
  Additional information: User failed a can* method check for right 4 (CREATE) on item Type: Item_Rack ID: -1
  Backtrace :
  ./src/CommonDBTM.php:3117                          
  ./src/CommonDBRelation.php:2207                    CommonDBTM->check()
  ./src/CommonDBTM.php:2888                          CommonDBRelation->check()
  ./src/Item_Rack.php:541                            CommonDBTM->initForm()
  ./front/item_rack.form.php:92                      Item_Rack->showForm()
  ...Glpi/Controller/LegacyFileLoadController.php:64 require()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\LegacyFileLoadController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:208        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./src/Glpi/Kernel/Kernel.php:201                   Symfony\Component\HttpKernel\Kernel->handle()
  ./public/index.php:78                              Glpi\Kernel\Kernel->handle()

### Relevant log output

```shell
From `glpi/files/_log/access-errors.log` (or Docker container stdout/stderr):


User ID: `2` tried to execute an invalid request on `/front/item_rack.form.php?ajax=true&orientation=0&position=42&racks_id=2`.
  Additional information: User failed a can* method check for right 4 (CREATE) on item Type: Item_Rack ID: -1
  Backtrace :
  ./src/CommonDBTM.php:3117                          
  ./src/CommonDBRelation.php:2207                    CommonDBTM->check()
  ./src/CommonDBTM.php:2888                          CommonDBRelation->check()
  ./src/Item_Rack.php:541                            CommonDBTM->initForm()
  ./front/item_rack.form.php:92                      Item_Rack->showForm()
  ...Glpi/Controller/LegacyFileLoadController.php:64 require()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\LegacyFileLoadController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:208        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./src/Glpi/Kernel/Kernel.php:201                   Symfony\Component\HttpKernel\Kernel->handle()
  ./public/index.php:78                              Glpi\Kernel\Kernel->handle()

Page URL

No response

Steps To reproduce

No response

Your GLPI setup information

GLPI information

GLPI: 11.0.9 ( => /var/www/glpi)
Installation mode: DOCKER
Current language: zh_CN
Source Integrity: OK

Server

Operating system: Linux tech 6.8.0-87-generic #​88-Ubuntu SMP PREEMPT_DYNAMIC Sat Oct 11 09:28:41 UTC 2025 x86_64
PHP: 8.5.10 apache2handler
PHP extensions: Core, date, lexbor, openssl, pcre, sqlite3, zlib, ctype, curl, uri, json, fileinfo, filter, hash, iconv, SPL, mbstring, Zend OPcache, session, standard, PDO, pdo_sqlite, bz2, posix, random, Reflection, libxml, SimpleXML, tokenizer, dom, xml, xmlreader, xmlwriter, mysqlnd, apache2handler, apcu, bcmath, Phar, exif, gd, intl, ldap, mysqli, redis, soap, sodium, zip
Setup: disable_functions="" max_execution_time="60" max_input_vars="5000" memory_limit="256M" post_max_size="20M" session.cookie_secure="0" session.cookie_httponly="1" session.cookie_samesite="Strict" session.save_handler="files" upload_max_filesize="20M"
Web server: Apache ()
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Database:
Server Software: (Ubuntu)
Server Version: 8.0.46-0ubuntu0.24.04.4
Server SQL Mode: STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION
Parameters: test_sys_glpi@db:3306/test_sys_glpi
Host info: db via TCP/IP
Requirements:

PHP version (8.5.10) is supported.

OS and PHP are relying on 64 bits integers.

Sessions configuration is OK.

Allocated memory is sufficient.

Following extensions are installed: dom, fileinfo, filter, libxml, simplexml, tokenizer, xmlreader, xmlwriter.

mysqli extension is installed

curl extension is installed

gd extension is installed

intl extension is installed

mbstring extension is installed

zlib extension is installed

bcmath extension is installed

The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present.

openssl extension is installed

Database engine version (8.0.46) is supported.

The log file has been created successfully.

Write access to /var/glpi/files/_cache has been validated.

Write access to /var/glpi/files/_cron has been validated.

Write access to /var/glpi/files has been validated.

Write access to /var/glpi/files/_graphs has been validated.

Write access to /var/glpi/files/_lock has been validated.

Write access to /var/glpi/files/_pictures has been validated.

Write access to /var/glpi/files/_plugins has been validated.

Write access to /var/glpi/files/_rss has been validated.

Write access to /var/glpi/files/_sessions has been validated.

Write access to /var/glpi/files/_tmp has been validated.

Write access to /var/glpi/files/_uploads has been validated.

Security key files are accessibles.
Sessions configuration is secured.

exif extension is installed

ldap extension is installed

Following extensions are installed: bz2, Phar, zip.

Zend OPcache extension is installed

Following extensions are installed: ctype, iconv, sodium.

Write access to /var/glpi/marketplace has been validated.

Timezones seems not loaded, see https://glpi-install.readthedocs.io/en/latest/timezones.html.

GLPI constants

GLPI_ROOT: "/var/www/glpi"

GLPI_VERSION: "11.0.9"

GLPI_SCHEMA_VERSION: "11.0.9@7b129479687ebafebb6966eaa1d72cb683390613"

GLPI_FILES_VERSION: "11.0.9-47928273"

GLPI_MIN_PHP: "8.2"

GLPI_MAX_PHP: "8.5"

GLPI_YEAR: "2026"

GLPI_I18N_DIR: "/var/www/glpi/locales"

GLPI_CONFIG_DIR: "/var/glpi/config"

GLPI_VAR_DIR: "/var/glpi/files"

GLPI_MARKETPLACE_DIR: "/var/glpi/marketplace"

GLPI_LOG_DIR: "/var/glpi/logs"

GLPI_INSTALL_MODE: "DOCKER"

GLPI_ENVIRONMENT_TYPE: "production"

GLPI_ALLOW_IFRAME_IN_RICH_TEXT: false

GLPI_SERVERSIDE_URL_ALLOWLIST: ["^\n                        (http|https|feed)://                                                # protocol\n                        (\n                            (?:\n                                (?:xn--[a-z0-9-]++\.)*+xn--[a-z0-9-]++                      # a domain name using punycode\n                                    |\n                                (?:[\pL\pN\pS\pM\-\]++\.)+[\pL\pN\pM]++                    # a multi-level domain name\n                                    |\n                                [a-z0-9\-\]++                                              # a single-level domain name\n                            )\.?\n                                |                                                           # or\n                            \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}                              # an IP address\n                                |                                                           # or\n                            \[\n                                (?:(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){6})(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:::(?:(?:(?:[0-9a-f]{1,4})):){5})(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:[0-9a-f]{1,4})))?::(?:(?:(?:[0-9a-f]{1,4})):){4})(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,1}(?:(?:[0-9a-f]{1,4})))?::(?:(?:(?:[0-9a-f]{1,4})):){3})(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,2}(?:(?:[0-9a-f]{1,4})))?::(?:(?:(?:[0-9a-f]{1,4})):){2})(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,3}(?:(?:[0-9a-f]{1,4})))?::(?:(?:[0-9a-f]{1,4})):)(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,4}(?:(?:[0-9a-f]{1,4})))?::)(?:(?:(?:(?:(?:[0-9a-f]{1,4})):(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9]))\.){3}(?:(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])))))))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,5}(?:(?:[0-9a-f]{1,4})))?::)(?:(?:[0-9a-f]{1,4})))|(?:(?:(?:(?:(?:(?:[0-9a-f]{1,4})):){0,6}(?:(?:[0-9a-f]{1,4})))?::))))\n                            \]                                                              # an IPv6 address\n                        )\n                        (?:/ (?:[\pL\pN\pS\pM\-._\!$&'()+,;=:@]|%[0-9A-Fa-f]{2}) )*     # a path\n                        (?:\? (?:[\pL\pN\-._\~!$&'\\+,;=:@/?]|%[0-9A-Fa-f]{2}) )?    # a query (optional)\n                    $~ixuD"]

GLPI_DISALLOWED_UPLOADS_PATTERN: "/\.(php\d*|phar)$/i"

GLPI_TELEMETRY_URI: "https://telemetry.glpi-project.org"

GLPI_NETWORK_MAIL: "glpi@teclib.com"

GLPI_NETWORK_SERVICES: "https://services.glpi-network.com"

GLPI_MARKETPLACE_ENABLE: 3

GLPI_MARKETPLACE_PRERELEASES: false

GLPI_MARKETPLACE_ALLOW_OVERRIDE: true

GLPI_MARKETPLACE_MANUAL_DOWNLOADS: true

GLPI_USER_AGENT_EXTRA_COMMENTS: ""

GLPI_DOCUMENTATION_ROOT_URL: "https://links.glpi-project.org"

GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: "1"

GLPI_LOG_LVL: "warning"

GLPI_SKIP_UPDATES: false

GLPI_STRICT_ENV: false

GLPI_AJAX_DASHBOARD: "1"

GLPI_CALDAV_IMPORT_STATE: 0

GLPI_CENTRAL_WARNINGS: "1"

GLPI_SYSTEM_CRON: false

GLPI_TEXT_MAXSIZE: "4000"

GLPI_WEBHOOK_ALLOW_RESPONSE_SAVING: "0"

GLPI_WEBHOOK_CRA_MANDATORY: false

GLPI_ALTCHA_MODE: "interactive"

GLPI_ALTCHA_MAX_NUMBER: 50000

GLPI_ALTCHA_EXPIRATION_INTERVAL: "PT20M"

GLPI_DOC_DIR: "/var/glpi/files"

GLPI_CACHE_DIR: "/var/glpi/files/_cache"

GLPI_CRON_DIR: "/var/glpi/files/_cron"

GLPI_GRAPH_DIR: "/var/glpi/files/_graphs"

GLPI_LOCAL_I18N_DIR: "/var/glpi/files/_locales"

GLPI_LOCK_DIR: "/var/glpi/files/_lock"

GLPI_PICTURE_DIR: "/var/glpi/files/_pictures"

GLPI_PLUGIN_DOC_DIR: "/var/glpi/files/_plugins"

GLPI_RSS_DIR: "/var/glpi/files/_rss"

GLPI_SESSION_DIR: "/var/glpi/files/_sessions"

GLPI_TMP_DIR: "/var/glpi/files/_tmp"

GLPI_UPLOAD_DIR: "/var/glpi/files/_uploads"

GLPI_INVENTORY_DIR: "/var/glpi/files/_inventories"

GLPI_THEMES_DIR: "/var/glpi/files/_themes"

GLPI_PLUGINS_DIRECTORIES: ["/var/glpi/marketplace","/var/www/glpi/plugins"]

GLPI_NETWORK_API_URL: "https://services.glpi-network.com/api"

GLPI_NETWORK_REGISTRATION_API_URL: "https://services.glpi-network.com/api/registration/"

GLPI_MARKETPLACE_PLUGINS_API_URI: "https://services.glpi-network.com/api/marketplace/"

SQL replicas

Not active

Notifications

Way of sending emails: PHP

Anything else?

No response

[trasher]

Please provide all requested information, GLPI setup is missing.

[zriver-z]

@trasher I have updated the requested GLPI setup information above.

[BrianBonnell]

I am running into this issue as well on GLPI 11.0.9 running in docker, I had to do a SQL injection to get a switch to show up in the Racks, I might have to do the same process for all the other Assets needing to be put into a Rack within the GLPI GUI.

Find the Switch:
root@docker-lxc3:~# docker exec -it glpi-db-1 mysql -u glpi -p -e "SELECT id, name FROM glpi.glpi_networkequipments;"

SQL Inject the rack location:
root@docker-lxc3:~# docker exec -it glpi-db-1 mysql -u glpi -p -e "INSERT INTO glpi.glpi_items_racks (items_id, itemtype, racks_id, position, orientation) VALUES (2, 'NetworkEquipment', 1, 11, 0);"

Flush the Cache:
root@docker-lxc3:~# docker exec -u 0 -it glpi-glpi-1 rm -rf /var/www/html/files/_cache/*

This will be a real pain to do this for 22 physical servers and about 16 more switches.

[daggettbiber]

same issue here. Can confirm the bug since update to 11.0.9 (from 11.0.8)

[GuidoWilden]

Confirming this on a separate, non-Docker install: GLPI 11.0.9, bare-metal Ubuntu (Apache + MariaDB, not Docker), upgraded from a prior 11.0.x release. Same symptom exactly — clicking + on any rack unit position returns 403, reproduces for Super-Admin with full rights on Datacenter and all Asset types, on both pre-existing and brand-new empty racks. Same access-errors.log signature (Item_Rack ID: -1 failing the CREATE check in CommonDBRelation).

Confirms this isn't Docker-specific or plugin-related (reproduced with no custom permission tweaks beyond stock Super-Admin).

The workaround posted above (direct SQL insert into glpi_items_racks + cache flush) matches our schema exactly (racks_id, itemtype, items_id, position, orientation), so it's a viable stopgap for anyone blocked on this in the meantime.

[cconard96]

Bug introduced by 6482e73#diff-1c287fc0dfa26310f9893221db6d2240153b7781f6fd6adb344a93860873a814 from the change to line 504 in CommonDBRelation.

May be security related. Cannot find the public PR. That said, do not just revert the change locally.

IMO creation permission checks from CommonDBRelation have always been problematic since they get checked before a form is even shown and yet try to check the input to see if the two sides of the relationship are valid. Obviously in most cases there is only one side known at that point, the Rack in this case, and this forces us to explicitly bypass this check in many cases by setting $mustBeAttached_1 and $mustBeAttached_2 to false even though from a data consistency standpoint, we do not want either side to be unlinked in the database.

[BrianBonnell]

Community note: This only works for Network equipment below should be the correct Non-Docker version. Same for the above docker version works only for adding network equipment.

Find the Switch:
mysql -u glpi -p -e "SELECT id, name FROM glpi.glpi_networkequipments;"

SQL Inject the rack location:
mysql -u glpi -p -e "INSERT INTO glpi.glpi_items_racks (items_id, itemtype, racks_id, position, orientation) VALUES (2, 'NetworkEquipment', 1, 11, 0);"

I am still working on the correct query for both the docker and non-docker version for searching for Computer/Servers that need rack positions....having a bit of a fight with that one....when I do get it right....I will post it for those that need it.