GLPI EUVD-2026-87272

Requires an authenticated GLPI account with the hotliner or technician role that has access to the LDAP user-import feature, and the instance must be configured to authenticate/import users from an LDAP directory with a configured default filter. Exploitation is limited to reading LDAP objects the default filter was meant to exclude - there is no write, code execution, or impact to GLPI's own data. Limiting factors: privilege requirement (PR:H per NVD; realistically an elevated helpdesk role), an operational LDAP integration must exist, and only versions before 10.0.26 / 11.0.8 are affected.

This is a modest, well-gated information-disclosure issue that CVSS metrics correctly rank as low-medium (NVD 4.0 base 4.6). The vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N models it as network-reachable but privilege-gated (PR:H) with only subsequent-system confidentiality (SC:H, VC/VI/VA all N) - i.e. no impact to GLPI itself, only leakage from the connected LDAP directory. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all real-world-exploitation signals point to low urgency. The source commit confirms the true nature precisely: buildLdapFilter() interpolated an attacker-controlled criterion value straight into an LDAP filter string, so this is CWE-90 LDAP filter injection, not the 'Authentication Bypass' the tags claim. The main uncertainty is PR: NVD chose PR:H, but the description says a hotliner or technician (elevated helpdesk roles, not administrators) can trigger it via the user-import feature, so PR:L is arguably more accurate - this raises rather than lowers real-world reachability slightly. Overall a genuine but niche defense-in-depth fix, not a priority-patch emergency.

An authenticated GLPI user holding a hotliner or technician role opens the LDAP user-import screen and supplies a search criterion containing LDAP filter metacharacters (e.g. parentheses, wildcards, or boolean operators). Because the value is concatenated into the LDAP filter without escaping, the injected clause overrides the administrator's configured default filter, returning directory objects (users/accounts) that were intentionally excluded. No public exploit code exists, but the technique is trivial for anyone who understands LDAP filter syntax.