CVE-2026-26027 is a high-severity cross-site scripting vulnerability (CWE-79) in the GLPI asset and IT management software, affecting versions 11.0.0 through 11.0.5. An unauthenticated attacker can inject and store malicious scripts via the inventory endpoint, potentially leading to execution of arbitrary scripts in the context of users viewing the affected pages. The vulnerability is fixed in GLPI version 11.0.6. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to store and execute arbitrary scripts in the context of users accessing the inventory endpoint, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected system.

Upgrade GLPI to version 11.0.6 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 11.0.6, applying this official update is the recommended remediation. No additional mitigation steps are indicated by the vendor.