Which versions of GLPI are affected by CVE-2026-44281?

GLPI IT asset management software versions 0.78-10.0.24 and 11.0.0-11.0.6 contain a flaw that allows authorized staff with read-only permissions to access IT asset information beyond their designated…. A patch is available.

How to fix or mitigate CVE-2026-44281?

Within 24 hours: Identify all GLPI deployments running affected versions (0.78-10.0.24 and 11.0.0-11.0.6). Within 7 days: Deploy vendor-released patches (upgrade to 10.0.25 or 11.0.7 respectively) across all affected systems. Within 30 days: Audit access logs to identify any unauthorized asset visibility and validate that role-based access controls are functioning correctly.

GLPI CVE-2026-44281

Q: What is the CVSS score of CVE-2026-44281?

CVE-2026-44281 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34102 HIGH

Missing Authorization (CWE-862)

2026-06-03 GitHub_M

Authentication Bypass Glpi

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:31 vuln.today

Patch available

Jun 03, 2026 - 17:01 EUVD

CVSS changed

Jun 03, 2026 - 16:22 NVD

7.0 (HIGH)

CVE Published

Jun 03, 2026 - 14:06 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.

AnalysisAI

Authorization bypass in GLPI IT asset management software (versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6) permits an authenticated user holding only the config READ permission to access a specific asset object that should be outside their authorization scope. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact. Vendor patches are available in 10.0.25 and 11.0.7.

Technical ContextAI

GLPI is an open-source IT Service Management (ITSM) and asset inventory platform widely used in enterprise and public-sector environments to track hardware, software, tickets, and contracts. The root cause is CWE-862 (Missing Authorization): a code path serving a specific asset object fails to verify that the requesting user holds the appropriate object-level permission and instead accepts the broader 'config READ' permission, which is intended only for viewing configuration data. The affected component is identified in the CPE string cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* and the issue is tracked in the upstream GHSA-prjc-xwmh-rhxw advisory.

RemediationAI

Vendor-released patch: upgrade to GLPI 10.0.25 if running the 10.x branch, or to 11.0.7 if running the 11.x branch, per the upstream advisory at https://github.com/glpi-project/glpi/security/advisories/GHSA-prjc-xwmh-rhxw. Until the upgrade is applied, the most effective compensating control is to tighten the assignment of the 'config READ' profile permission so that only administrators retain it - this is a low-friction change because config READ is rarely needed by standard helpdesk or technician profiles, though it will prevent affected users from viewing the GLPI configuration screens they previously had access to. Additionally, audit existing accounts holding config READ for unexpected access and place GLPI behind authenticated network controls (VPN or SSO with MFA) to reduce the chance that a stolen credential reaches the vulnerable endpoint; the trade-off is added login friction for legitimate users.