CVE-2026-128078

EUVD-2026-125629
GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
5.3 MEDIUM
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
glpi-projectglpi
9.5.0 ≤
𝑥
< 10.0.27
CNA
glpi-projectglpi
11.0.0 ≤
𝑥
< 11.0.9
CNA
Common Weakness Enumeration
References
https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d
https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9
https://github.com/glpi-project/glpi/releases/tag/10.0.27
https://github.com/glpi-project/glpi/releases/tag/11.0.9
https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp