CVE-2026-55214 is a stored cross-site scripting vulnerability in the GLPI IT management software. Specifically, versions 11.0.6 through 11.0.7 allow an authenticated technician to store active markup in supplier website fields. When other users open the suppliers list for the affected item, the stored malicious script executes, leading to potential compromise of user sessions or other XSS impacts. The issue is categorized under CWE-116, indicating improper encoding or escaping of output. The vulnerability is resolved in GLPI version 11.0.8.

This vulnerability allows an authenticated technician to inject malicious scripts that execute in the browsers of users who view the affected supplier list. The CVSS 4.0 score of 8.5 indicates a high severity with network attack vector, low attack complexity, no attack prerequisites, and partial user interaction required. Successful exploitation could lead to session hijacking, credential theft, or other client-side impacts depending on the payload.

Upgrade GLPI to version 11.0.8 or later, where this vulnerability is fixed. No other mitigations are specified or required once the official fix is applied.