CVE-2026-45801 in Glpi
Summary
by MITRE • 09/25/2026
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
GLPI serves as a comprehensive open-source platform for IT asset management, service desk operations, and project tracking, widely deployed within enterprise environments to centralize infrastructure visibility and workflow automation. The software relies on strict role-based access control mechanisms to ensure that sensitive configuration changes are restricted to authorized administrators with appropriate privileges. Within the architecture of GLPI versions ranging from 0.72 through 10.0.26 and up to 11.0.8, a critical authorization flaw exists in the user settings module. This vulnerability allows an authenticated user who lacks the necessary administrative permissions to bypass privilege boundaries and enable debug mode within their own profile or potentially across the application context depending on session handling specifics.
The technical root cause of this issue lies in insufficient server-side validation during the update process for user preferences. When a request is submitted to modify user settings, the backend logic fails to adequately verify whether the requesting entity possesses the required administrative rights before processing the change that activates debug mode. This oversight represents a classic case of broken access control where the application trusts client-supplied data or session state without performing rigorous authorization checks against the central permission matrix. By enabling debug mode, an attacker can trigger verbose error reporting and logging mechanisms that are typically disabled in production environments to maintain performance and security hygiene.
The operational impact of this vulnerability is significant because it facilitates information disclosure through enhanced diagnostic output. Debug mode often exposes detailed stack traces, database query structures, internal file paths, and potentially sensitive configuration parameters within application logs or on-screen error messages. For an attacker with low-level access, such as a standard helpdesk operator or end-user, gaining the ability to view these details can provide critical intelligence about the underlying technology stack, database schema, and server architecture. This information is instrumental in planning further exploitation steps, including SQL injection attacks, path traversal exploits, or targeted phishing campaigns based on revealed internal structures. Furthermore, excessive logging may lead to denial of service conditions by filling disk space with verbose data if left unchecked over time.
This vulnerability aligns directly with Common Weakness Enumeration identifier CWE-269, which describes Improper Privilege Assignment, as the application fails to enforce the intended security boundary between standard users and administrators. In terms of offensive cybersecurity frameworks, this flaw supports techniques categorized under ATT&CK T1078, specifically Valid Accounts, where an adversary leverages legitimate credentials to gain access, combined with aspects of T1592, Gather Victim Host Information, as the debug output aids in reconnaissance activities against the target infrastructure. The ability to trigger verbose errors also relates to CWE-209, Generation of Error Message Containing Sensitive Information, which highlights the risk of leaking internal state details to unauthorized parties.
To mitigate this vulnerability and secure GLPI deployments, organizations must immediately upgrade to version 10.0.26 or later for the legacy branch, or version 11.0.8 and above for the current release line where these authorization checks have been corrected. Until an upgrade is feasible, administrators should implement network-level controls such as web application firewalls that can detect and block requests attempting to modify user settings with suspicious parameters indicative of debug mode activation. Additionally, enforcing strict output filtering on server error pages ensures that even if debug mode is inadvertently enabled or exploited, sensitive stack traces are not returned directly to the client interface. Regular audits of role-based access controls and continuous monitoring for unusual logging patterns can further reduce the risk surface associated with this class of authorization bypass flaws.