Which versions of GLPI are affected by CVE-2026-42318?

GLPI asset management deployments running versions 9.5.0-10.0.24 or 11.0.0-11.0.6 are vulnerable to unauthorized data destruction by authenticated planning users, with no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-42318?

Within 24 hours: Identify and inventory all GLPI deployments with current version documentation. Within 7 days: Deploy vendor-released patches-version 10.0.25 for the 10.x branch and version 11.0.7 for the 11.x branch-across all affected systems. Within 30 days: Verify patch application and conduct audit log review for suspicious object deletion activity from low-privilege planning module accounts.

GLPI CVE-2026-42318

Q: What is the CVSS score of CVE-2026-42318?

CVE-2026-42318 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34095 HIGH

Missing Authorization (CWE-862)

2026-06-03 GitHub_M

Authentication Bypass Glpi Glpi Project

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:31 vuln.today

Patch available

Jun 03, 2026 - 17:01 EUVD

CVSS changed

Jun 03, 2026 - 16:22 NVD

7.0 (HIGH)

CVE Published

Jun 03, 2026 - 15:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.

AnalysisAI

Unauthorized object deletion in GLPI versions 9.5.0 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated low-privilege users with planning access to delete arbitrary objects across the asset and IT management platform. The flaw stems from a missing authorization check (CWE-862) tied to the planning module, and no public exploit identified at time of analysis. Patches are available in 10.0.25 and 11.0.7.

Technical ContextAI

GLPI (cpe:2.3:a:glpi-project:glpi) is a widely deployed open-source IT asset, helpdesk, and service management application written in PHP. The vulnerability is rooted in CWE-862 (Missing Authorization): the planning subsystem exposes a deletion code path that does not verify the caller's rights against the target object's type before performing the delete operation. As a result, the authorization boundary that normally segregates planning entries from CMDB assets, tickets, users, and configuration objects is bypassed, letting any account holding the planning delete permission act on resources it should not control.

RemediationAI

Vendor-released patch: upgrade to GLPI 10.0.25 (for the 10.x branch) or GLPI 11.0.7 (for the 11.x branch) as published in advisory https://github.com/glpi-project/glpi/security/advisories/GHSA-w7mr-3vwm-2j22. If immediate upgrade is not possible, apply the vendor-documented workaround by disabling delete rights on the User's planning profile (Administration → Profiles → Planning → remove the Delete permission); the trade-off is that legitimate users will no longer be able to remove their own planning entries through the UI and will need an administrator to clean up stale planning records. Audit existing profile assignments to identify which non-admin roles currently hold planning delete rights and review logs for unexpected deletions of assets, tickets, or users before pulling the workaround.