Vulnerability
CVE-2026-53625
Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.
- Sharing
- PUBLIC-OSINT
- Confidence
- 100
- Source
- The CVE Program
- Updated
- 26/09/2026 05:22
Description
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.
Aliases and classifications
CWE-862Missing Authorization
Minimised technical details
No raw data- cisa kev
- False
Provenance
Public references
- https://github.com/glpi-project/glpi/commit/eb1b4299e81abeac764902b422cf7fcd59ac85d0
https://github.com/glpi-project/glpi/commit/eb1b4299e81abeac764902b422cf7fcd59ac85d0 - https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/releases/tag/11.0.8 - https://github.com/glpi-project/glpi/releases/tag/10.0.26
https://github.com/glpi-project/glpi/releases/tag/10.0.26 - https://github.com/glpi-project/glpi/commit/9329f1ecac8099b54c2ca4dd770d78f82e1e6db8
https://github.com/glpi-project/glpi/commit/9329f1ecac8099b54c2ca4dd770d78f82e1e6db8 - https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7
https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7
EudorIA correlation
Intel catalogue
The vulnerability is also available in the EudorIA editorial catalogue.
Open EudorIA analysisPresence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.