CVE-2026-108726: Missing Authorization in glpi-project GLPI

CVE-2026-108726 is a missing authorization vulnerability in GLPI through version 12.0.0, specifically in the ajax/map.php component. The vulnerability arises because the canView() authorization check is omitted, allowing authenticated low-privileged users to perform searches on item types they are not authorized to view. Attackers can craft requests specifying item types and search criteria to obtain sensitive information such as match counts, titles, and coordinates for entities including Contact, Supplier, Contract, and Budget.

Authenticated users with low privileges can bypass intended access controls to obtain information about item types they should not be able to view. This exposure includes counts, titles, and coordinates of sensitive entities, potentially leading to information disclosure within the affected GLPI environment. There is no indication of remote code execution or privilege escalation beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ajax/map.php to trusted users only and monitor for unusual activity involving this endpoint. Avoid granting unnecessary privileges to users who do not require access to sensitive item types.