CVE-2026-108726

The GLPI application through version 12.0.0 is vulnerable to a missing authorization vulnerability in the ajax/map.php component. The root cause is the omission of the canView() check, which allows authenticated low-privileged users to search for itemtypes they are not authorized to view. By subm...