---
id: CVE-2026-53628
title: GLPI is a free asset and IT management software package
summary: >-
  GLPI is a free asset and IT management software package. From 0.84 until
  10.0.26 and 11.0.8, an administrator holding the Update auth and sync or
  Update auth, sync and 2FA right can change the authentication method and
  disable two-factor…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-285
vendor: glpi-project
product: glpi
affected:
  - 'glpi >= 0.84, < 10.0.26'
  - 'glpi >= 11.0.0, < 11.0.8'
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:17:28.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53628'
references:
  - url: >-
      https://github.com/glpi-project/glpi/commit/27cc088f2b134fdcca0643b2485c9bfcc779bc4f
    label: security-advisories@github.com
  - url: >-
      https://github.com/glpi-project/glpi/commit/f06a790d64ea18f8ad4ba5cf8236115dd882c364
    label: security-advisories@github.com
  - url: 'https://github.com/glpi-project/glpi/releases/tag/10.0.26'
    label: security-advisories@github.com
  - url: 'https://github.com/glpi-project/glpi/releases/tag/11.0.8'
    label: security-advisories@github.com
  - url: >-
      https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-25T19:15:38.971Z'
---

## Overview

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.