CVE-2026-53627: CWE-862: Missing Authorization in glpi-project glpi
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
AI Analysis
Technical Summary
CVE-2026-53627 is a missing authorization vulnerability (CWE-862) in GLPI, a free asset and IT management software. From versions 11.0.0 to 11.0.7 inclusive, low-privileged authenticated users can exploit the new API (v2) to perform update operations beyond their normal permissions due to inconsistent enforcement of authorization checks in the API update flow. The vulnerability is resolved in version 11.0.8.
Potential Impact
An attacker with low-privileged authenticated access can perform unauthorized update operations through the API, potentially modifying data or configurations they should not be able to change. This could lead to unauthorized changes within the GLPI system, impacting data integrity and management processes. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user's level.
Mitigation Recommendations
Upgrade GLPI to version 11.0.8 or later, where this missing authorization issue is fixed. No other mitigations are indicated or necessary once the official fix is applied.
CVE-2026-53627: CWE-862: Missing Authorization in glpi-project glpi
Description
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
CVSS v4.0
Score 6.0medium
Affected software
glpi-project
glpi
pkg:github/glpi-project/glpiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53627 is a missing authorization vulnerability (CWE-862) in GLPI, a free asset and IT management software. From versions 11.0.0 to 11.0.7 inclusive, low-privileged authenticated users can exploit the new API (v2) to perform update operations beyond their normal permissions due to inconsistent enforcement of authorization checks in the API update flow. The vulnerability is resolved in version 11.0.8.
Potential Impact
An attacker with low-privileged authenticated access can perform unauthorized update operations through the API, potentially modifying data or configurations they should not be able to change. This could lead to unauthorized changes within the GLPI system, impacting data integrity and management processes. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user's level.
Mitigation Recommendations
Upgrade GLPI to version 11.0.8 or later, where this missing authorization issue is fixed. No other mitigations are indicated or necessary once the official fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T20:16:59.647Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab6beaaf7a7c5410621ae4b
Added to database: 09/25/2026, 18:34:18 UTC
Last enriched: 09/25/2026, 18:48:00 UTC
Last updated: 09/26/2026, 02:43:26 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.