SB20260721151 - Multiple vulnerabilities in GLPI
Published: July 21, 2026 Updated: July 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-53627)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform unauthorized update operations.
The vulnerability exists due to improper access control in the API v2 when handling update requests. A remote user can send crafted API requests to perform unauthorized update operations.
The issue affects operations that are forbidden to low-privilege users through the user interface.
2) Improper privilege management (CVE-ID: CVE-2026-45801)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to enable debug mode without authorization.
The vulnerability exists due to improper privilege management in the debug mode functionality when handling requests to enable debug mode. A remote user can send a request to enable debug mode to enable debug mode without authorization.
3) Improper Authorization (CVE-ID: CVE-2026-53628)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify users' authentication methods and disable two-factor authentication outside the intended entity scope.
The vulnerability exists due to improper authorization in the authentication method update functionality when handling administrative updates to user authentication settings. A remote privileged user can change authentication methods for users outside their entity scope to modify users' authentication methods and disable two-factor authentication outside the intended entity scope.
Exploitation requires the "Update auth and sync" or "Update auth, sync and 2FA" right.
4) Improper Authorization (CVE-ID: CVE-2026-55217)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify knowledge base comments and translations.
The vulnerability exists due to improper authorization in knowledge base comments and translations handling when handling requests. A remote user can create, update, or delete knowledge base comments and translations to modify knowledge base comments and translations.
5) LDAP injection (CVE-ID: CVE-2026-49469)
CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access unexpected objects on the LDAP server.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the user import feature when processing LDAP filter input. A remote privileged user can supply a crafted LDAP filter to access unexpected objects on the LDAP server.
The issue allows bypass of the default LDAP filter.
6) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-55214)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary script code in a user's browser.
The vulnerability exists due to improper encoding or escaping of output in supplier website fields when rendering the item's suppliers list. A remote privileged user can store a malicious script payload in a supplier website field to execute arbitrary script code in a user's browser.
User interaction is required to open the item's suppliers list.
7) Improper access control (CVE-ID: CVE-2026-57152)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in document permission logic when checking access to a document linked to a targeted item. A remote user can access a document without proper link confirmation to disclose sensitive information.
Exploitation is possible only under certain conditions.
8) Cross-site scripting (CVE-ID: CVE-2026-53610)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in dashboards when handling a crafted URL containing malicious input. A remote attacker can send a specially crafted URL to execute arbitrary script in the victim's browser.
User interaction is required to open the crafted URL.
9) SQL injection (CVE-ID: CVE-2026-53629)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to SQL injection in the history tab endpoint when handling a crafted URL request. A remote user can send a specially crafted URL to disclose sensitive information.
10) Improper Authentication (CVE-ID: CVE-2026-52848)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass two-factor authentication.
The vulnerability exists due to improper authentication in the login phase when processing a self-crafted URL. A remote attacker can use a self-crafted URL to bypass two-factor authentication.
11) Improper access control (CVE-ID: CVE-2026-53625)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper access control in the authtype API when handling authentication method changes for user accounts. A remote privileged user can modify the authentication method of another user account to escalate privileges.
Under specific conditions, this may be used to target a super-admin account and steal access to that account.
12) SQL injection (CVE-ID: CVE-2026-47678)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL commands.
The vulnerability exists due to SQL injection in the dropdown values fetching endpoint when handling dropdown value requests. A remote user can send a specially crafted request to execute arbitrary SQL commands.
13) Improper access control (CVE-ID: CVE-2026-47679)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to delete arbitrary files on the server.
The vulnerability exists due to improper access control in file deletion functionality when handling deletion requests. A remote user can request deletion of arbitrary server-hosted files to delete arbitrary files on the server.
14) Path traversal (CVE-ID: CVE-2026-48482)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to path traversal in the form import feature when importing a crafted form. A remote privileged user can upload a malicious script to execute arbitrary code.
15) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-53626)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in document access permission logic when handling requests for documents linked to targeted items. A remote user can request access to a document to disclose sensitive information.
Exploitation is possible when the permission check does not properly verify that the document is actually linked to the targeted item.
16) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2026-49470)
CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass two-factor authentication and take over accounts.
The vulnerability exists due to improper restriction of excessive authentication attempts in the TOTP-based 2FA mechanism when submitting TOTP codes during authentication. A remote attacker can perform brute-force attempts against the 2FA verification process to bypass two-factor authentication and take over accounts.
Remediation
Install update from vendor's website.
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-p68f-rv24-mc54
- https://github.com/glpi-project/glpi/security/advisories/GHSA-3vhr-7p54-cqhw
- https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp
- https://github.com/glpi-project/glpi/security/advisories/GHSA-xm3v-3g6q-g9q8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf
- https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg
- https://github.com/glpi-project/glpi/security/advisories/GHSA-7v5q-w6f3-2v8p
- https://github.com/glpi-project/glpi/security/advisories/GHSA-76v9-ch69-g67r
- https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh
- https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch
- https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7
- https://github.com/glpi-project/glpi/security/advisories/GHSA-v774-5g3p-vxg2
- https://github.com/glpi-project/glpi/security/advisories/GHSA-x5r8-r6vj-79cw
- https://github.com/glpi-project/glpi/security/advisories/GHSA-6whc-g4h2-98rm
- https://github.com/glpi-project/glpi/security/advisories/GHSA-q9rc-v6vm-q5mm
- https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x