CVE-2026-55217: CWE-285: Improper Authorization in glpi-project glpi
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
AI Analysis
Technical Summary
CVE-2026-55217 is an improper authorization vulnerability (CWE-285) in the GLPI asset and IT management software. It affects versions >=0.85 <10.0.26 and >=11.0.0 <11.0.8. The vulnerability permits low-privileged authenticated users to perform unauthorized create, update, or delete operations on knowledge base comments and translations. This could lead to unauthorized modification of content within the knowledge base. The vulnerability has been addressed and fixed in GLPI versions 10.0.26 and 11.0.8.
Potential Impact
The vulnerability allows low-privileged authenticated users to bypass authorization controls and manipulate knowledge base comments and translations. This could undermine the integrity and trustworthiness of the knowledge base content, potentially impacting IT and asset management processes relying on GLPI. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the low-privileged user context.
Mitigation Recommendations
Upgrade GLPI to version 10.0.26 or later, or 11.0.8 or later, where this improper authorization vulnerability has been fixed. No other mitigation or workaround is specified. Patch status is confirmed by the vendor advisory information.
CVE-2026-55217: CWE-285: Improper Authorization in glpi-project glpi
Description
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
CVSS v4.0
Score 5.3medium
Affected software
glpi-project
glpi
pkg:github/glpi-project/glpiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55217 is an improper authorization vulnerability (CWE-285) in the GLPI asset and IT management software. It affects versions >=0.85 <10.0.26 and >=11.0.0 <11.0.8. The vulnerability permits low-privileged authenticated users to perform unauthorized create, update, or delete operations on knowledge base comments and translations. This could lead to unauthorized modification of content within the knowledge base. The vulnerability has been addressed and fixed in GLPI versions 10.0.26 and 11.0.8.
Potential Impact
The vulnerability allows low-privileged authenticated users to bypass authorization controls and manipulate knowledge base comments and translations. This could undermine the integrity and trustworthiness of the knowledge base content, potentially impacting IT and asset management processes relying on GLPI. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the low-privileged user context.
Mitigation Recommendations
Upgrade GLPI to version 10.0.26 or later, or 11.0.8 or later, where this improper authorization vulnerability has been fixed. No other mitigation or workaround is specified. Patch status is confirmed by the vendor advisory information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T16:16:32.628Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab6c1fff7a7c5410625562a
Added to database: 09/25/2026, 18:48:31 UTC
Last enriched: 09/25/2026, 19:03:13 UTC
Last updated: 09/26/2026, 02:43:34 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.