GLPI CVE-2026-42321

Attacker must hold a valid GLPI account with the 'technician' role (CVSS PR:H) and the ability to write to the asset locked tab on a target asset. A second authenticated user - typically a higher-privileged administrator - must subsequently view the affected asset's locked tab in their browser to trigger payload execution (CVSS UI:A). Exploitation is constrained to GLPI instances running 10.0.4 through 10.0.24 (or 11.x prior to 11.0.7) and requires network reachability to the GLPI web interface; no special non-default configuration is required since the locked tab is a standard asset feature.

Risk signals are mixed and point to a real but bounded threat. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:A reflects network reachability and low attack complexity but explicitly requires high privileges (a technician account already inside GLPI) and active user interaction by a victim, which dampens mass-exploitation potential. CISA SSVC reports exploitation as 'none' and 'not automatable' with 'total' technical impact, and no EPSS score was supplied; the issue is not in CISA KEV and no public exploit identified at time of analysis. The headline 8.4 score is therefore more representative of session-takeover impact than of likelihood - this is a privileged-insider or credential-compromise risk against helpdesk/admin staff, not an internet-facing pre-auth RCE.

A malicious or compromised technician account stores a crafted JavaScript payload in the locked tab of a high-value asset record; when an administrator later opens that asset's locked tab in the GLPI web UI, the script executes in the admin's browser session and can issue authenticated requests to escalate privileges, exfiltrate inventory or credential data, or pivot ticket workflows. No public exploit identified at time of analysis, but the attack pattern is trivial for anyone with the required role.