GLPI EUVD-2026-87275

Requires an authenticated GLPI administrator who holds the 'Update auth and sync' or 'Update auth, sync and 2FA' right (User::UPDATEAUTHENT) - this is a privileged, non-default delegated right, matching CVSS PR:H. Exploitation is only meaningful in multi-entity GLPI deployments, because the flaw is the failure to enforce the TARGET user's entity-scoped UPDATE permission when the actor operates on accounts outside their own entity scope (CVSS AT:P reflects this required cross-entity condition). No end-user interaction is needed (UI:N). It does not affect single-entity installations where the admin already legitimately controls all users, and it is limited to changing authentication method and toggling 2FA rather than arbitrary account modification.

This is a genuine but low-priority authorization flaw, not a high-severity emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, base 5.9) already encodes the two biggest limiters: PR:H means the attacker must already hold a privileged GLPI right (the 'Update auth and sync' / UPDATEAUTHENT administrative right), and AT:P (Attack Requirements: Present) reflects that the flaw only manifests against target user accounts that fall outside the acting administrator's entity scope. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so exploitation status is 'no public exploit identified at time of analysis' - the risk is entirely theoretical/insider-driven at this point. The NVD impact metrics (VC:H, VA:H) appear overstated: disabling 2FA and switching a foreign account's authentication method weakens that account's security posture and modifies its configuration, but it does not by itself disclose confidential data or take a system down, so a more defensible reading is a modest integrity impact with a scope change across entities. Bottom line: a real cross-tenant privilege-boundary defect worth patching, but gated behind an existing admin right and abnormal (out-of-scope) targeting, so it is high-CVSS-for-the-class rather than an urgent internet-facing risk.

A GLPI administrator in a multi-entity deployment who has been delegated only the 'Update auth and sync' right for their own entity navigates the user-account administration / mass-action flow and targets user accounts belonging to a different entity they should not control. Because the flow validated only the global UPDATEAUTHENT right and never the target user's entity-scoped UPDATE permission, the administrator switches those foreign users' authentication method and disables their two-factor authentication, weakening or hijacking accounts outside their authority. No public exploit code is available; this is an authenticated, network-reachable abuse of an over-broad admin right.