CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the
ajax/autocompletion.php autocompletion feature. The lack of correct
validation leads to recovery of the token generated via the password reset
functionality, and thus an authenticated attacker can set an arbitrary
password for any user. This vulnerability can be exploited to take control
of admin account. This vulnerability could be also abused to obtain other
sensitive fields like API keys or password hashes.