Glpi CVE-2026-25937

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) presents a nuanced risk picture. The requirement for high privilege (PR:H) and knowledge of valid user credentials significantly constrains the attack surface compared to unauthenticated exploits, yet the network-accessible attack vector (AV:N) and low attack complexity (AC:L) indicate that credential-equipped threat actors can easily execute the bypass. The high confidentiality and integrity impact ratings reflect the severity of account compromise in an IT management platform, where unauthorized access could lead to exposure of asset inventory, configuration data, and administrative privileges. While CVSS assigns 6.5 (medium-high), the real-world risk is moderate to moderately-high: exploitation requires prior credential compromise or credential theft, making this a post-initial-breach concern or relevant to targeted attacks against known users. The absence of noted KEV status and public POC suggests this is not yet widely exploited in the wild, though the straightforward nature of an authentication bypass means POC development is trivial. Organizations running GLPI should prioritize patching as part of routine credential-compromise incident response procedures.

An attacker obtains a GLPI user's credentials through credential stuffing, phishing, or password spray attacks. The attacker navigates to the GLPI login portal and enters the harvested credentials. Normally, GLPI would prompt the user to complete MFA (such as TOTP or SMS verification). However, due to the authentication bypass flaw in versions 11.0.0-11.0.5, the attacker is able to bypass this MFA requirement and gain immediate access to the user's account, potentially escalating privileges to administrative level if the compromised account had such permissions. This allows the attacker to view sensitive asset inventory, modify IT configuration records, or create backdoor administrative accounts for persistent access.