CVE-2026-49469 GLPI: LDAP filter injection in user import feature

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...

CVE-2026-49469

The asset and IT management software GLPI is vulnerable to an LDAP filter injection in the user import feature. In versions 0.70 through 10.0.26 and 11.0.8 , an authenticated hotliner or technician can submit crafted criteria to bypass the configured default LDAP filter. This allows the attacker ...

CVE-2026-49469 GLPI: LDAP filter injection in user import feature

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...

EUVD-2026-87272

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter...

PT-2026-99076

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected...

PT-2026-99064

Name of the Vulnerable Software and Affected Versions GLPI versions 0.72 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated user without the necessary permissions can enable debug mode because the user-setting update process fails to enforce the privilege boundary...

PT-2026-99065

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.25 GLPI versions prior to 11.0.8 Description Insufficient path validation in the profile-picture update flow allows any logged-in user to request the deletion of an arbitrary file hosted on the server selected...

PT-2026-99070

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A technician can manipulate the authtype value via the API to modify the authentication method of another user. In environments utilizing SSO logins or the lega...

PT-2026-99067

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated hotliner or technician can bypass the configured default LDAP filter by submitting crafted criteria through the user import feature. This allow...

PT-2026-99074

Name of the Vulnerable Software and Affected Versions GLPI versions 9.4.0 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An attacker with READ permissions on logs can craft a URL for the history tab to inject controlled values into a database query. This leads to SQL injection, a...

PT-2026-99073

Name of the Vulnerable Software and Affected Versions GLPI versions 0.84 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An administrator with Update auth and sync or Update auth, sync and 2FA permissions can modify the authentication method and disable two-factor authentication f...

PT-2026-99075

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.6 through 11.0.7 Description An authenticated technician can store active markup in supplier website fields. This leads to stored cross-site scripting XSS, where any user viewing the affected item's suppliers list triggers t...

PT-2026-99071

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.5 through 11.0.7 Description Permission logic in the software may grant access to a document without confirming if the document is linked to the targeted item. This allows a user to view a document linked to an inaccessible...

PT-2026-99066

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description A form administrator can utilize the Form import feature with a specially crafted illustration or scene identifier to perform a directory traversal attack, allowing files to be written outside th...

PT-2026-99069

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An attacker can craft a URL for a dashboard that reflects attacker-controlled markup due to insufficient output encoding. A user who opens this crafted URL triggers reflected cross-site scripting...

PT-2026-99068

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...

PT-2026-99072

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An issue exists where a low-privileged authenticated user can utilize the API v2 to execute update operations that are typically restricted within the user interface. This occurs because the API...

CVE-2026-55214: Improper Encoding or Escaping of Output

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version...

CVE-2026-53628: Improper Authorization

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator'...

CVE-2026-53626: Authorization Bypass Through User-Controlled Key

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to...