glpi vulnerabilities
CVEs whose affected-version data names the glpi package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
13 CVEsRSS
CVE-2026-49469Medium· 4.6GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter…
CVE-2026-53628Medium· 5.9GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor…
CVE-2026-45801Medium· 5.3GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege bou…
CVE-2026-55214High· 8.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored …
CVE-2026-53610High· 7.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL …
CVE-2026-49470High· 7.7GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentic…
CVE-2026-53626High· 7.1GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can …
CVE-2026-48482Critical· 9.4GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The i…
CVE-2026-53629High· 7.1PoCGLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This…
CVE-2026-55217Medium· 5.3GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization fo…
CVE-2026-53627Medium· 6.0GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the …
CVE-2026-47679High· 8.5GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selecte…
CVE-2026-53625High· 7.5PoCGLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the le…