GLPI EUVD-2026-87286

Requires an authenticated GLPI account with rights to update other users (the 'technician' profile described) but WITHOUT the UPDATEAUTHENT right, exploited through the REST API by supplying an authtype value in a user-update call. Exploitation to achieve account takeover is specifically scoped to instances configured to use the legacy REST API interface OR SSO/external authentication logins, since the attack works by switching a target (super-admin) account onto an authentication method the attacker controls. Limiting factors: valid technician credentials are needed (PR gated), the impactful takeover path depends on the non-default legacy-API/SSO configuration (captured as AT:P), and a suitable high-value target account (e.g. super-admin) must exist. Affects versions from 0.70 up to 10.0.26 and 11.0.8; patched in 10.0.26 and 11.0.8.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H, base 7.5) describes a network-reachable but privilege-gated flaw: PR:H plus AT:P signal that an already-privileged technician account AND a specific deployment configuration (legacy REST API interface or SSO logins) are both required, which materially limits opportunistic mass exploitation. This is a genuine CWE-862 missing-authorization defect confirmed by the vendor advisory (GHSA-94rp-v9f2-5rj7) and the fix commit, which adds a Session::haveRight(UPDATEAUTHENT) check before honoring an authtype change - so the technical claim is well-substantiated by source code, not just the description. No EPSS score, CISA KEV listing, or public POC was provided, and no SSVC decision data is present; per precision rules this is 'no public exploit identified at time of analysis.' The impact ceiling is high (super-administrator account takeover), but the combination of authenticated access, a non-default legacy/SSO configuration, and no evidence of active exploitation places this as a real-but-contained privilege-escalation issue rather than an urgent internet-wide emergency. Note: PR:H in the NVD vector is arguably overstated for a 'technician' role that merely needs user-update rights - PR:L is defensible, which would raise the practical accessibility somewhat.

An authenticated technician with user-management rights sends a crafted GLPI REST API request that sets the authtype field on a super-administrator's account to an external method (e.g. SSO/EXTERNAL). On instances using the legacy REST API interface or SSO logins, this reassigns the admin's authentication provider so the attacker can authenticate as that super-administrator, achieving full account takeover. No public POC was provided in the intelligence.