EUVD-2026-96892
GHSA-9wcj-67qp-cm59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged GLPI user
-
DeliveryCraft ajax/map.php request with restricted itemtype
-
ExploitOmit/bypass canView() authorization
-
ExecutionReceive counts, titles and coordinates
-
ImpactHarvest restricted entity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated GLPI account with at least low privileges (PR:L) and network access to the application's ajax/map.php endpoint; no user interaction or elevated/admin rights are needed. The specific prerequisite is the ability to submit itemtype and search parameters to the map AJAX handler, which skips the canView() authorization check for types such as Contact, Supplier, Contract, and Budget. Limiting factors: disclosure is scoped to items within the attacker's own entities, only metadata (match counts, titles, coordinates) is exposed rather than full records, and completely unauthenticated access is not possible. Affects GLPI versions through 12.0.0. |
| Impact | This is a genuine but low-severity information-disclosure issue, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, 5.3 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. There is no EPSS score, KEV listing, or SSVC decision provided in the input, so there is no signal of active or automatable exploitation - exploitation status rests solely on a public technical writeup. The practical risk is bounded: an attacker must already hold a valid low-privileged GLPI account, and the payoff is metadata (match counts, titles, coordinates) for itemtypes like Contact, Supplier, Contract, and Budget within the user's own entities, not full record contents or write access. Net: a real, confirmable authorization gap worth patching in routine cycles, but not a high-urgency, widely-weaponized threat absent any EPSS/KEV evidence. |
| Exploit ScenarioDerived | A low-privileged GLPI user who should not have visibility into financial or contact data sends a crafted request to ajax/map.php specifying a restricted itemtype (e.g., Contract or Budget) plus search criteria. Because the endpoint omits the canView() check, the server returns match counts, titles, and map coordinates for those items within the user's entities, leaking data the UI would normally hide. A public technical writeup on hackmd documents the vulnerable code path (ajax/map.php lines 44-52), lowering the effort required to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Authenticated low-privileged users can bypass authorization checks in GLPI through 12.0.0 via the ajax/map.php endpoint, disclosing match counts, titles, and coordinates of itemtypes such as Contact, Supplier, Contract, and Budget within their entities. This missing authorization (CWE-862) is a low-severity information-disclosure issue, as per our independent assessment; no public exploit has been identified at time of analysis, and the CVSS 3.1 vector indicates limited confidentiality impact (C:L) with no integrity or availability impact. Affected users must be authenticated with at least low privileges (PR:L) and network access to the endpoint.
RemediationAI
No vendor-released patch is identified at time of analysis. Administrators should implement compensating controls. The primary recommendation is to modify the GLPI code to add the missing canView() authorization check in ajax/map.php before processing itemtype searches, as shown in the vulnerable code reference (lines 44-52). Alternatively, restrict access to the ajax/map.php endpoint using web server configuration (e.g., Nginx/Apache rules) to only allow trusted users or admin roles, though this may break legitimate map functionality for other users. Another option is to disable the map feature entirely if not needed. Monitor logs for requests to ajax/map.php with unusual itemtype parameters (e.g., Contact, Supplier, Contract, Budget) from low-privileged accounts. Apply the principle of least privilege by ensuring users have minimal necessary roles. Stay informed by monitoring the GLPI GitHub repository and VulnCheck advisory for future patches. Trade-offs: Code modification requires development effort and testing; blocking endpoint may impact functionality; disabling map feature may reduce usability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GLPI is an open-source IT asset management and helpdesk software written in PHP. The ajax/map.php script handles map-related functionality, and it contains a missing authorization check (CWE-862) that omits the canView() function call on lines 44-52 (as referenced in the GitHub link). This allows an authenticated user to query itemtypes they do not have permission to view, bypassing access controls. The CPE cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* indicates all versions of GLPI, but the description specifies through 12.0.0. The attack requires the attacker to craft itemtype and search parameters, and the response reveals metadata like match counts, titles, and coordinates limited to the attacker's entities (e.g., their organization). Both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and our independent CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rate this as low severity due to limited confidentiality impact. The tags indicate PHP and authentication bypass, though this is more accurately an authorization bypass.
Know when Glpi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable AJAX endpoint (AV:N/AC:L) requires a low-privileged authenticated account (PR:L), no user interaction, and leaks only limited metadata, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installati
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers ca
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Rat
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking an
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _pr
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Rated high
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Rated high severity (
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. Rated hig
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
GLPI is a Free Asset and IT Management Software package. Rated high severity (CVSS 8.1), this vulnerability is remotely
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands vi
Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL co
Exploit-DB