Glpi CVE-2026-26263

Remote unauthenticated attacker exploiting GLPI versions 11.0.0 through 11.0.5. Requires access to GLPI's Search engine functionality. Time-based blind SQL injection requires attacker to measure response timing differences; no victim interaction needed.

This vulnerability presents elevated real-world risk despite high attack complexity rating. The CVSS 8.1 score reflects network-accessible attack vector (AV:N) with no authentication required (PR:N), enabling remote exploitation without credentials. High attack complexity (AC:H) suggests exploitation requires specific conditions or timing, typical for blind SQL injection which demands iterative queries and precise payload crafting. Impact ratings are all High (C:H/I:H/A:H), indicating potential for complete database compromise, data manipulation, and service disruption. No CISA KEV listing and absence of public exploit code suggests no confirmed active exploitation, but SQL injection vulnerabilities historically attract rapid weaponization once disclosed. The unauthenticated attack surface significantly amplifies risk for internet-facing GLPI instances. GLPI's role managing critical IT asset inventories means successful exploitation could expose organization-wide infrastructure details, credentials, and configuration data. While attack complexity provides some natural defense, the lack of authentication barrier makes this a priority remediation target, particularly for publicly accessible deployments.

An external attacker identifies an internet-accessible GLPI instance and targets the Search engine endpoint with crafted SQL injection payloads designed to cause time delays. Through iterative requests with conditional time-based queries, the attacker extracts administrator credentials, API tokens, and asset inventory data character-by-character from the database. With elevated privileges obtained, the attacker could modify asset records, plant backdoor accounts, or leverage database access for lateral movement within the organization's infrastructure. The unauthenticated nature means no initial credential theft or social engineering is required to initiate the attack.