CVE-2026-55217

The asset and IT management software GLPI is vulnerable to an authorization bypass in versions 0.85 until 10.0.26 and 11.0.8 . A low-privileged authenticated user can perform unauthorized actions, including creating, updating, or deleting knowledge base comments and translations . This issue is a...

CVE-2026-55217 GLPI: Unallowed modfication of knowbase items comments and translations

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

EUVD-2026-87280

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-55217 GLPI: Unallowed modfication of knowbase items comments and translations

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0...

CVE-2026-53628 GLPI: Unallowed authentication method update by administrator

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

CVE-2026-53628

The GLPI asset and IT management software package is vulnerable to an authentication bypass in versions 0.84 through 10.0.26 and 11.0.8 . An administrator possessing the Update auth and sync or Update auth, sync and 2FA rights can modify authentication methods and disable two-factor authenticatio...

CVE-2026-53628 GLPI: Unallowed authentication method update by administrator

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

CVE-2026-53628 GLPI: Unallowed authentication method update by administrator

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

EUVD-2026-87275

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

CVE-2026-45801

The GLPI asset and IT management software package is vulnerable to unauthorized debug mode activation. In versions 0.72 through 10.0.26 and 11.0.8 , an authenticated user lacking the necessary permissions can enable debug mode because the user-setting update fails to enforce the intended privileg...

EUVD-2026-87274

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...

CVE-2026-45801 GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...

CVE-2026-45801 GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...

CVE-2026-45801 GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

EUVD-2026-87273

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627

The asset and IT management software GLPI versions 11.0.0 through 11.0.8 is vulnerable to an authorization bypass. A low-privileged authenticated user can exploit the API (v2) to perform update operations that are restricted through the standard user interface. This occurs because the API update ...

CVE-2026-49469 GLPI: LDAP filter injection in user import feature

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...