CVE-2026-53627
GLPI is a free asset and IT management software package
- Risk score
- 40/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable a…
- Affected
- See advisory
- Fix
- Upgrade the product to 11.0.8 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.0 medium
References
Original description
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
Last activity 25 Sep 2026. Patch Forecast updates every hour.