GLPI CVE-2026-44281

Exploitation requires an authenticated GLPI session whose profile includes the 'config READ' permission (CVSS PR:H), network reachability to the GLPI web interface (AV:N), and that the target GLPI instance is running a vulnerable version in the 0.78-10.0.24 or 11.0.0-11.0.6 range. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker cannot be fully unauthenticated; the config READ permission is an administrative-grade right that is not assigned to standard helpdesk/technician profiles in typical deployments, which materially narrows the exploitable population.

Signals are mixed and lean toward moderate-but-not-urgent priority. The CVSS 4.0 base score of 7.0 reflects network reachability (AV:N) and low complexity (AC:L) but requires high privileges (PR:H) - meaning the attacker must already hold an authenticated GLPI account with config READ rights, sharply limiting the realistic threat population to insiders or attackers who have already compromised a privileged account. There is a notable inconsistency between the description (which describes a read-only data exposure, a confidentiality issue) and the CVSS vector (VC:N/VI:H/VA:H, which encodes integrity and availability impact with no confidentiality impact) - this discrepancy should be verified with the vendor advisory before tuning detection or risk scoring. CISA SSVC corroborates the lower-urgency reading: Exploitation=none, Automatable=no, Technical Impact=partial, and there is no KEV listing. No public exploit identified at time of analysis and no EPSS score was provided in the input. Net assessment: patch on a normal cycle; treat as elevated only for GLPI deployments where config READ is broadly granted.

An attacker who has obtained or been granted a low-tier GLPI account that includes the 'config READ' profile permission - for example, a junior technician or a compromised service account - logs into the GLPI web interface over the network and requests the specific asset object endpoint that fails to enforce object-level authorization, retrieving inventory data they were not entitled to see. No user interaction is required and the attack works against default deployments where the config READ permission has been broadly assigned. No public exploit identified at time of analysis.