Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN781 _____________________________________________________________________ DATE : 27/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running glpi versions prior to 11.0.8, 10.0.26. ===================================================================== https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7 https://github.com/glpi-project/glpi/security/advisories/GHSA-v774-5g3p-vxg2 https://github.com/glpi-project/glpi/security/advisories/GHSA-x5r8-r6vj-79cw https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh https://github.com/glpi-project/glpi/security/advisories/GHSA-76v9-ch69-g67r https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg _____________________________________________________________________ MFA bypass Critical cedric-anne published GHSA-hgr8-qvp5-mhch Package glpi (glpi) Affected versions >= 11.0.0 Patched versions 11.0.8 Description Impact During the login phase, any user can use a self-crafted URL to skip the one time password verification, and therefore make the two factor authentication protection unefficient. Patches Upgrade to 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity Critical 9.2/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-52848 Weaknesses No CWEs Credits @assakafpix assakafpix Reporter @SebSept SebSept Remediation developer _____________________________________________________________________ Stored XSS in suppliers High cedric-anne published GHSA-8v8p-w8mq-wqcg Package glpi (glpi) Affected versions >= 11.0.6 Patched versions 11.0.8 Description Impact An authenticated technician user can store an XSS payload in a supplier website fields. Any user opening the item's suppliers list would trigger the XSS. Patches Upgrade to 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction Passive Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-55214 Weaknesses Weakness CWE-116 _____________________________________________________________________ Privilege Escalation via authtype API manipulation High cedric-anne published GHSA-94rp-v9f2-5rj7 Package glpi (glpi) Affected versions >= 0.70, < 11.0.0 >= 11.0.0 Patched versions 10.0.26 11.0.8 Description Impact A technician can change the authentication method of any user. This can be used, under specific conditions, to change the authentication method of a super-admin user and steal its account. Patches Upgrade to 10.0.26 or 11.0.8. Workaround Disable legacy api rest or disable SSO logins. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 7.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-53625 Weaknesses No CWEs Credits @7h30th3r0n3 7h30th3r0n3 Reporter @byteoverride byteoverride Reporter _____________________________________________________________________ SQL injection in dropdowns High cedric-anne published GHSA-v774-5g3p-vxg2 Package glpi (glpi) Affected versions >= 9.4.0, < 11.0.0 >= 11.0.0 Patched versions 10.0.26 11.0.8 Description Impact Any authenticated user can perform an SQL injection using the dropdown values fetching endpoint. Patches Upgrade to 10.0.26 or 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.7/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-47678 Weaknesses Weakness CWE-89 Credits @camberty camberty Reporter _____________________________________________________________________ Arbitrary file deletion High cedric-anne published GHSA-x5r8-r6vj-79cw Package glpi (glpi-project) Affected versions >= 10.0.0, < 11.0.0 >= 11.0.0 Patched versions 10.0.26 11.0.8 Description Impact Any logged GLPI user can request a deletion of any file hosted by the server. Patches Upgrade to 10.0.26 or 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity High Availability High CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H CVE ID CVE-2026-47679 Weaknesses No CWEs Credits @dubs3c dubs3c Reporter _____________________________________________________________________ SQL injection in history tab High cedric-anne published GHSA-cpcj-x335-5cmh Package glpi (glpi) Affected versions >= 9.4.0, < 11.0.0 >= 11.0.0 Patched versions 10.0.26 11.0.8 Description Impact An attacker can craft a custom URL to perform a SQL injection using the history tab endpoint. Patches Upgrade to 10.0.26 or 11.0.8. Workaround Remove READ right on logs. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 7.1/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity None Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-53629 Weaknesses Weakness CWE-89 Credits @5kr1pt 5kr1pt Reporter _____________________________________________________________________ Reflected XSS in dashboards High cedric-anne published GHSA-76v9-ch69-g67r Package glpi (glpi) Affected versions >= 11.0.0 Patched versions 11.0.8 Description Impact An attacker can craft an URL containing a malicious payload and trigger a reflected XSS. Patches Upgrade to 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 7.1/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction Active Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-53610 Weaknesses Weakness CWE-79 Credits @sol0lvl sol0lvl Reporter _____________________________________________________________________ Stored XSS in suppliers High cedric-anne published GHSA-8v8p-w8mq-wqcg Package glpi (glpi) Affected versions >= 11.0.6 Patched versions 11.0.8 Description Impact An authenticated technician user can store an XSS payload in a supplier website fields. Any user opening the item's suppliers list would trigger the XSS. Patches Upgrade to 11.0.8. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction Passive Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-55214 Weaknesses Weakness CWE-116 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================