EUVD-2026-115904Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Technician profile
-
DeliveryClone existing Super-Admin account
-
ExploitSet attacker-controlled login and password
-
ExecutionLog in as new Super-Admin
-
ImpactFull control of GLPI
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated GLPI session under the Technician profile (or any profile granted rights to clone/create users) and the presence of a higher-privileged account - a Super-Admin - to clone. The exact trigger is the user-cloning feature: the attacker clones the Super-Admin, supplies a new login and password they control, and the pre-patch User::getCloneRelations()/prepareInputForClone() copies all Profile_User and Group_User assignments without any permission check. Limiting factors: exploitation is not available to anonymous/unauthenticated visitors, it depends on the acting profile actually having user cloning/creation capability, and a Super-Admin (or otherwise more-privileged) account must exist to be copied. |
| Impact | This is a genuine but access-gated priority rather than an internet-wide emergency. The CVSS 4.0 vector (8.6, High) shows AV:N and AC:L with no user interaction, and the impact is total - cloning a Super-Admin yields VC:H/VI:H/VA:H (full GLPI compromise). The decisive limiter is privilege: the attacker must already be an authenticated GLPI user holding the Technician profile (or any profile able to clone/create users). The vendor vector sets PR:H, but the described actor - a standard Technician - is not an administrator; an honest reading is PR:L (authenticated, non-admin, needs user-management rights), which I reflect in my independent assessment and flag as a discrepancy to verify. No EPSS score, no CISA KEV entry, and no confirmed working exploit code were supplied, so this is not evidence of active, widespread exploitation; the vuln.today decision label is 'this_week', not act_now/emergency. Net: treat as a real insider/compromised-account escalation risk (a low-trust helpdesk technician can seize full control), prioritize patching within the week, but it does not carry the mass-exploitation profile of an unauthenticated network flaw. |
| Exploit ScenarioDerived | A disgruntled or compromised GLPI user holding the Technician profile uses the built-in user-cloning feature to duplicate an existing Super-Admin account, then assigns the clone a login and password of their choosing and logs in with full Super-Admin rights. Because the vector is AV:N/AC:L/UI:N the operation needs only authenticated web access and no victim interaction, though it does require the Technician to have user cloning/creation rights. No public working exploit code is confirmed, but VulnCheck published a technical advisory describing the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Privilege escalation in GLPI's user-cloning feature lets an authenticated Technician clone an existing Super-Admin account and assign the clone new credentials they control, resulting in a fully attacker-owned administrative login. All releases from 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 are affected, because User::getCloneRelations() and prepareInputForClone() duplicate every Profile_User and Group_User assignment without checking whether the cloning user could grant those rights. Vendor patches and public commits are available, no public exploit code has been identified at time of analysis, and exploitation is access-gated: it requires a Technician (or other user-cloning-capable) session plus the presence of a more privileged account to copy, making this a genuine but scoped priority rather than an internet-wide emergency.
RemediationAI
Vendor-released patch: upgrade to GLPI 10.0.28 for the 10.x line and 11.0.10 for the 11.x line as stated in the advisory package metadata, or to 10.0.27 / 11.0.9 as the advisory prose states, confirming the correct target release with the vendor before rollout. Patch data from the vendor is listed as available and the code change is public in commits 10a827c8c1868a0a65ab977d30878ff16547d9a7 and d30faa501e8b549ae507615b05e7d99dacfe5d98, so this is a this-week upgrade rather than an emergency out-of-band action. Because the vulnerability requires a Technician session that can clone or create users plus a higher-privileged account in the same instance, interim exposure reduction means tightening who holds user-creation and cloning rights and auditing existing accounts for unexpected Super-Admin profile assignments or recently created look-alike accounts with changed logins, passwords, or entity scopes; these controls are partial, and the vendor frames updating as the complete fix, so they should be treated as compensating measures only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GLPI is a PHP/MySQL IT asset and helpdesk platform whose authorization model is entity-scoped: the Profile_User table binds a user to a profile (for example Technician or Super-Admin) within a specific entity, and Group_User binds users to groups, which themselves carry rights per entity. The flaw is an instance of CWE-269 (Improper Privilege Management) in the CommonDBTM clone lifecycle. Prior to the fix, User::getCloneRelations() listed Profile_User and Group_User as relations to duplicate verbatim, and prepareInputForClone() re-added those rows for the new user without any authorization test, so the clone inherited the source account's full privilege set regardless of the cloning session's own rights. The upstream commit removes both classes from the blind relation list and instead iterates the source user's Profile_User and Group_User records, calling can(-1, CREATE, $data) on each before insertion, so only assignments the acting session could legitimately grant are carried over. Accompanying functional tests assert that a Technician cloning the Super-Admin user does not inherit Super-Admin, that cross-entity authorizations outside the cloner's scope are dropped, and that in-scope profiles and group memberships are still copied. Note the scoring divergence in the supplied data: the CVSS 4.0 vector carries PR:H while the independent CVSS 3.1 assessment uses PR:L, and the operative view is that a low-privileged authenticated Technician session is sufficient, provided the acting profile actually holds user creation/cloning capability.
Know when Glpi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Technician is an authenticated non-admin user so PR:L (not PR:H); network web UI, low complexity, no interaction; cloning grants full Super-Admin, so C/I/A all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.
Technical POC Analysis
CWE-269 (Improper Privilege Management): the user-cloning path replicates authorization records without checking whether the cloning session is allowed to grant them.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A privilege-escalation flaw in GLPI, the IT asset and helpdesk platform, allows any authenticated Technician-level user to clone a Super-Admin account and take full control of the administrative login. Because Technicians are common throughout service-desk operations, the population able to trigger this is broad, and successful abuse grants complete administrative control over the GLPI environment and the sensitive asset, inventory and credential data it holds. Leadership should care because this converts a routine support-role account into organization-wide administrative compromise without requiring any external attacker.
Vendor-released patch: GLPI 10.0.28 and 11.0.10
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installati
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers ca
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Rat
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking an
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _pr
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Rated high
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Rated high severity (
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. Rated hig
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
GLPI is a Free Asset and IT Management Software package. Rated high severity (CVSS 8.1), this vulnerability is remotely
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands vi
Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL co
Exploit-DB