CVE-2026-53628 is an improper authorization vulnerability (CWE-285) in the GLPI asset and IT management software. It affects versions >=0.84 <10.0.26 and >=11.0.0 <11.0.8. Administrators holding the 'Update auth and sync' or 'Update auth, sync and 2FA' rights can modify authentication methods and disable two-factor authentication for user accounts outside their authorized entity scope. This is due to inconsistent enforcement of entity-scoped update permissions in the user-account administration flow. The vulnerability allows privilege escalation within the administrative domain by circumventing entity boundaries. The vendor fixed this issue in GLPI versions 10.0.26 and 11.0.8.

An administrator with certain update rights can bypass entity-scoped restrictions to change authentication settings, including disabling two-factor authentication for user accounts outside their authorized entity. This could weaken account security and potentially facilitate unauthorized access or privilege escalation within the GLPI environment. The impact is limited to administrators with these specific rights and does not affect users without such privileges.

This vulnerability is fixed in GLPI versions 10.0.26 and 11.0.8. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if the system is updated. Patch status is confirmed fixed by the vendor in these versions.