Unauthorized Access in GLPI Asset Management Software by Free IT Vendor
CVE-2026-55217
5.3MEDIUM
What is CVE-2026-55217?
GLPI, a free asset and IT management software, contains a vulnerability that permits low-privileged authenticated users to create, update, or delete knowledge base comments and translations, bypassing the necessary authorization checks for specific content. This flaw affects versions from 0.85 up to 10.0.26, along with 11.0.8. It is crucial for users of affected versions to update to secure releases, 10.0.26 or 11.0.8, to mitigate this security risk.
Affected Version(s)
glpi >= 0.85, < 10.0.26 < 0.85, 10.0.26
glpi >= 11.0.0, < 11.0.8 < 11.0.0, 11.0.8