CVE-2026-108726 in GLPI
Summary
by MITRE • 10/11/2026
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in GLPI versions up to 12.0.0 represents a critical failure in access control logic within the application's geographic mapping interface. Specifically, the flaw resides in the ajax/map.php endpoint, which is designed to retrieve location data for various items managed by the system. While GLPI implements role-based access controls that restrict users from viewing sensitive entities such as Contacts, Suppliers, Contracts, and Budgets based on their assigned privileges, this specific endpoint fails to enforce these restrictions during search operations. The root cause of the issue is a missing authorization check; specifically, the code omits the necessary invocation of the canView() method before processing requests for item types that require elevated permissions. This oversight allows authenticated users with low-privileged accounts to bypass standard visibility filters and access data intended only for higher-level administrators or specific functional roles.
From an operational perspective, this vulnerability enables unauthorized information disclosure through a mechanism often referred to as enumeration via search results. Although the attacker may not be able to view full details of restricted items directly through normal interfaces, they can submit crafted requests containing specific item types and search criteria to the vulnerable endpoint. The system responds by returning match counts, titles, and geographic coordinates for these hidden entities within the user's assigned entity scope. This capability effectively allows an attacker to map out the existence and location of sensitive assets or personnel that should remain invisible to their level of access. For instance, a low-privileged helpdesk technician could discover the locations and identities of high-level management contacts or financial budget records simply by querying for them in the mapping interface, thereby gaining insights into organizational structure and critical data points without proper authorization.
This flaw aligns with CWE-284, which describes Improper Access Control, as it involves a failure to enforce restrictions on what an authenticated user can access. Furthermore, from a threat modeling perspective consistent with the MITRE ATT&CK framework, this vulnerability facilitates Reconnaissance activities, specifically under techniques related to Gathering Victim Organization Information and potentially Discovery of Network Services or Data Structure. The ability to enumerate hidden entities provides attackers with valuable intelligence that can be leveraged for further exploitation phases, such as social engineering attacks against identified individuals or targeted phishing campaigns based on discovered organizational hierarchies.
To mitigate this vulnerability, immediate patching is required by upgrading GLPI to a version later than 12.0.0 where the access control logic in ajax/map.php has been corrected to include proper validation of user permissions before returning data. In environments where an upgrade cannot be performed immediately, network-level controls such as web application firewalls can be configured to restrict access to the map-related endpoints based on user roles or IP addresses if feasible. Additionally, security teams should review logging mechanisms to detect unusual patterns of requests targeting restricted item types via this endpoint, which could indicate active exploitation attempts. Regular audits of role-based access control configurations are also recommended to ensure that all API and AJAX endpoints consistently enforce permission checks across the entire application surface area.