CVE-2026-121559 in Glpi
Summary
by MITRE • 11/03/2026
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in GLPI versions 10.0.0 through 10.0.27 and 11.0.0 through 11.0.9 represents a critical privilege escalation flaw rooted in the application's user cloning mechanism. This issue specifically affects authenticated users who possess at least the Technician profile level, which is typically intended for operational support staff with limited administrative privileges. The core of the vulnerability lies within the User::getCloneRelations() function, which is responsible for handling the relational data associated with a user account during the duplication process. Instead of performing strict permission checks to validate whether the current user has the authority to clone high-privilege accounts or restrict what attributes are copied, the function indiscriminately copies all Profile_User and Group_User assignments from the source account to the newly created cloned account. This lack of validation allows a lower-privileged user to target an existing Super-Admin account, initiate a clone operation, and receive a new account that inherits the full suite of administrative permissions associated with the original profile.
From a technical perspective, this flaw is classified under CWE-269, which denotes Improper Privilege Control. The vulnerability arises because the application fails to enforce proper access control policies when performing actions that modify security-sensitive attributes such as user roles and group memberships. By bypassing these checks during the cloning process, the system effectively allows an attacker to elevate their privileges from a standard operational role to full administrative control without requiring any additional authentication factors or explicit authorization for such high-level changes. This behavior contradicts the principle of least privilege, which dictates that users should only be granted the minimum levels of access necessary to perform their job functions. The absence of these safeguards in the cloning logic creates a direct path for unauthorized elevation of privileges within the GLPI environment.
The operational impact of this vulnerability is severe, as it compromises the integrity and security posture of the entire IT service management infrastructure managed by GLPI. An attacker who successfully exploits this flaw can create an administrative account that operates with full Super-Admin capabilities. This includes unrestricted access to all system configurations, sensitive ticket data, user information, and plugin settings. With such elevated privileges, an adversary could exfiltrate confidential organizational data, modify critical system parameters to disrupt operations, install malicious plugins or scripts for persistent backdoor access, or further pivot into other connected systems depending on the integration depth of GLPI with external services. The ability to clone accounts also complicates forensic investigations and audit trails, as multiple administrative accounts may appear legitimate while being controlled by an unauthorized entity.
This vulnerability aligns with several tactics in the MITRE ATT&CK framework, particularly T1078 Valid Accounts, where attackers use valid credentials to gain access, and more specifically T1098 Account Manipulation, which involves adding or modifying user accounts to maintain persistence or escalate privileges. The exploitation of this flaw allows an attacker to establish a foothold with high-level permissions that can be used for long-term unauthorized access. Mitigation strategies must prioritize immediate patching to the latest stable versions of GLPI, specifically version 10.0.28 or later and version 11.0.10 or later, where this logic has been corrected to include proper permission checks during the cloning process. In environments where upgrading is not immediately feasible, administrators should enforce strict access controls by limiting who can perform user clone operations, ideally restricting this capability exclusively to existing Super-Admins with multi-factor authentication enabled. Additionally, implementing robust monitoring and alerting for unusual account creation patterns or privilege changes can help detect potential exploitation attempts in real time. Regular audits of user roles and group memberships are also recommended to ensure that no unauthorized administrative accounts have been created through similar vectors.