What is the CVSS score of CVE-2026-23624?

CVE-2026-23624 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Glpi are affected by CVE-2026-23624?

Organizations using versions starting from 0.71 to should be aware of moderate risk from CVE-2026-23624 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-23624?

Within 30 days: Identify affected systems running versions starting from 0.71 to and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Glpi CVE-2026-23624

MEDIUM

Session Fixation (CWE-384)

2026-02-04 security-advisories@github.com

Information Disclosure Glpi Glpi Project

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 18:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

AnalysisAI

GLPI versions 0.71 through 10.0.22 and 11.0.4 are vulnerable to session hijacking when SSO-based remote authentication is enabled, allowing a local attacker to impersonate another user by stealing an active session on the same machine. An authenticated attacker with local access can exploit this by leveraging SSO variables to gain unauthorized access to victim sessions without requiring elevated privileges. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-384 (Session Fixation). Affects Glpi. GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .