CVE-2026-49469: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in glpi-project glpi
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
AI Analysis
Technical Summary
CVE-2026-49469 describes an LDAP injection vulnerability in the GLPI asset and IT management software. The flaw exists in the user import feature, where authenticated hotliners or technicians can submit specially crafted criteria that bypass the configured default LDAP filter. This improper neutralization of special elements in LDAP queries (CWE-90) enables unauthorized access to LDAP objects that the filter intended to exclude. The vulnerability affects GLPI versions >=0.70 <10.0.26 and >=11.0.0 <11.0.8 and is resolved in versions 10.0.26 and 11.0.8.
Potential Impact
An authenticated user with hotliner or technician privileges can bypass LDAP filtering restrictions, potentially gaining access to LDAP objects that should be restricted. This could lead to unauthorized information disclosure within the LDAP directory. The CVSS 4.6 (medium severity) reflects that the attack requires privileges and no user interaction, with network attack vector and high scope impact.
Mitigation Recommendations
Upgrade GLPI to version 10.0.26 or later, or 11.0.8 or later, where this LDAP injection vulnerability is fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-49469: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in glpi-project glpi
Description
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
CVSS v4.0
Score 4.6medium
Affected software
glpi-project
glpi
pkg:github/glpi-project/glpiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49469 describes an LDAP injection vulnerability in the GLPI asset and IT management software. The flaw exists in the user import feature, where authenticated hotliners or technicians can submit specially crafted criteria that bypass the configured default LDAP filter. This improper neutralization of special elements in LDAP queries (CWE-90) enables unauthorized access to LDAP objects that the filter intended to exclude. The vulnerability affects GLPI versions >=0.70 <10.0.26 and >=11.0.0 <11.0.8 and is resolved in versions 10.0.26 and 11.0.8.
Potential Impact
An authenticated user with hotliner or technician privileges can bypass LDAP filtering restrictions, potentially gaining access to LDAP objects that should be restricted. This could lead to unauthorized information disclosure within the LDAP directory. The CVSS 4.6 (medium severity) reflects that the attack requires privileges and no user interaction, with network attack vector and high scope impact.
Mitigation Recommendations
Upgrade GLPI to version 10.0.26 or later, or 11.0.8 or later, where this LDAP injection vulnerability is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-30T04:17:43.094Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab6beaaf7a7c5410621ae4a
Added to database: 09/25/2026, 18:34:18 UTC
Last enriched: 09/25/2026, 18:48:03 UTC
Last updated: 09/26/2026, 02:43:03 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.