GLPI: Unallowed authentication method update by administrator

published 2026-09-25 44 d ago modified 2026-09-30 40 d ago also EUVD-2026-87275

cvss: 5.9; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

Patch / fix

links 4

github.com/glpi-project/glpi@27cc088 commit
github.com/glpi-project/glpi@f06a790 commit
github.com/glpi-project/glpi/releases/tag/10.0.26 release
github.com/glpi-project/glpi/releases/tag/11.0.8 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 40 d ago (2026-09-30)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CNA	4.0	5.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

glpi-project glpi

Classification

Weakness

CWE-285 Improper Authorization

References

Sources

CVE List CVE-2026-53628
NVD CVE-2026-53628

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary