CVE-2026-121559High· 7.2▾ TwilightGLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.
GLPI >= 10.0.0 < 10.0.28GLPI >= 11.0.0 < 11.0.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45801Medium· 5.3GLPI is a free asset and IT management software package
CVE-2026-53631Medium· 5.3GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
CVE-2026-47678High· 8.7GLPI: Blind Time based SQLI in dropdowns
CVE-2026-52848Critical· 9.2GLPI: MFA bypass
CVE-2026-57152High· 7.1GLPI: Unallowed notifications sending
CVE-2026-108726Medium· 4.3GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check