CVE-2026-108726

EUVD-2026-96892
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.16%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
glpi-projectglpi
𝑥
≤ 12.0.0
CNA
Common Weakness Enumeration
References
https://github.com/glpi-project/glpi
https://github.com/glpi-project/glpi/blob/cd812fbc82eaa8d0356d0fb650842069c1c18f4e/ajax/map.php#L44-L52
https://hackmd.io/@haind03/glpi-ajax-map-missing-itemtype-authorization
https://www.vulncheck.com/advisories/glpi-through-12.0.0-missing-authorization-via-ajax-map-php