Information Disclosure Vulnerability in GLPI IT Management Software
CVE-2026-128078

5.3MEDIUM

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128078?

An information disclosure issue in GLPI versions 9.5.0 to 10.0.27 and 11.0.9 allows authenticated users to access ITIL follow-ups, tasks, or solutions generated from templates without proper read permission checks on the parent ticket, problem, or change. This could potentially expose sensitive information from parent items that the user should not have access to, depending on the template configuration. The vulnerability has been addressed in the latest releases, versions 10.0.27 and 11.0.9.

Affected Version(s)

glpi >= 9.5.0, < 10.0.27 < 9.5.0, 10.0.27

glpi >= 11.0.0, < 11.0.9 < 11.0.0, 11.0.9

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/6ac884ddb085a...
x_refsource_MISC
https://github.com/glpi-project/glpi/commit/f71c9e8935881...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.