Missing Authorization in GLPI Affects Access to Sensitive Item Types
CVE-2026-108726
5.3MEDIUM
What is CVE-2026-108726?
In GLPI versions up to 12.0.0, a vulnerability in the ajax/map.php file allows authenticated low-privileged users to bypass authorization checks for specific item types, such as Contact, Supplier, Contract, and Budget. By omitting key functions like canView(), attackers can manipulate search criteria to retrieve sensitive information, including match counts, titles, and coordinates of entities. This flaw poses a significant risk by potentially exposing confidential data to users lacking appropriate permissions.
Affected Version(s)
GLPI 0 <= 12.0.0
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology