GLPI EUVD-2026-87274

Requires a valid authenticated GLPI account that LACKS the Config update permission (PR:L); the attacker abuses the user-setting update endpoint to inject the use_mode parameter, which pre-patch code did not gate behind Config::canUpdate(). Affects default configurations of GLPI versions 0.72 through <10.0.26 and 11.0.0 through <11.0.8 - no special feature toggle or non-default setup is needed beyond having any authenticated low-privilege user. Limiting factors: authentication is mandatory (not remotely anonymous), no user interaction from a victim is required, and impact is confined to enabling debug-mode information exposure rather than data modification or code execution.

This is a low-to-moderate severity authorization flaw, correctly reflected by the NVD CVSS 4.0 score of 5.3. The vector (AV:N/AC:L/PR:L/UI:N) shows network-reachable, low-complexity exploitation but requires an authenticated account (PR:L), and impact is confined to low confidentiality (VC:L/SC:L) with no integrity or availability effect. The confirmed fix (commits e9d87651 / fb72d60c adding a Config::canUpdate() gate around the use_mode field in User::prepareInputForAdd/Update) verifies the root cause: a missing privilege check let a non-privileged user toggle debug mode via the user-setting update path. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is not evidence of active or widespread exploitation. The signals are internally consistent - there is no CVSS-vs-description conflict - and the practical value to an attacker is limited to the information debug mode surfaces (SQL queries, stack traces, timing, environment details), which is reconnaissance rather than direct compromise. Net: a real but low-priority hardening fix, not an urgent emergency; patch during normal maintenance.

A low-privileged but authenticated GLPI user (e.g., a self-service or technician account) sends a crafted user-setting update request including the use_mode parameter, which the pre-patch code accepts without checking Config::canUpdate(). This enables debug mode for their session, exposing SQL queries, backtraces, and system diagnostics they should not see, aiding further reconnaissance. No public proof-of-concept was identified at time of analysis.