CVE-2026-55217 in GLPI
Summary
by MITRE • 09/25/2026
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
GLPI serves as a comprehensive open-source platform for IT asset management, service desk operations, and project tracking, widely deployed within enterprise environments to streamline operational workflows. The software relies on role-based access control mechanisms to ensure that users interact only with resources appropriate to their assigned privileges. However, in versions ranging from 0.85 through 10.0.26 and up to version 11.0.8 inclusive, a critical authorization flaw exists within the knowledge base module. This vulnerability allows low-privileged authenticated users to perform write operations on sensitive content areas that should be restricted to administrators or specific high-level roles. Specifically, affected individuals can create, update, or delete comments associated with knowledge base articles and modify translation files without possessing the necessary permissions for these actions.
The technical root of this issue lies in an improper implementation of access control checks within the application logic governing the knowledge base interface. When a user submits requests to manipulate KB content or language settings, the backend fails to adequately verify whether the authenticated session holds the requisite administrative rights before processing the modification. This represents a classic case of broken object level authorization where the system trusts client-side inputs or session identifiers without rigorous server-side validation against the global permission matrix. Consequently, any user with valid login credentials can bypass intended restrictions and alter data that is typically considered immutable by standard users.
The operational impact of this vulnerability extends beyond simple unauthorized edits. An attacker leveraging this flaw could deface public-facing knowledge base articles to display misleading or malicious information, thereby undermining trust in the IT support infrastructure provided by the organization. Furthermore, the ability to delete comments can disrupt audit trails and remove critical context from troubleshooting records, complicating incident response efforts. In more severe scenarios involving translation files, an attacker might inject harmful content into language packs that could be rendered across multiple interfaces or integrated systems depending on how GLPI is configured within a broader IT ecosystem. This capability effectively allows privilege escalation in terms of data integrity and availability, even if the user does not gain direct system-level access.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. It also maps to MITRE ATT&CK techniques related to Defense Evasion through log tampering or data manipulation, as well as potential impacts on Availability if content is deleted en masse. The flaw highlights the importance of strict enforcement of least privilege principles in web applications that handle collaborative content and configuration settings.
To mitigate this risk, organizations running affected versions must immediately upgrade GLPI to version 10.0.27 or later for the 10.x branch, or version 11.0.9 or later for the 11.x branch, where these authorization checks have been corrected. Until patching is complete, administrators should review user roles and restrict access to knowledge base management features as much as possible through network-level controls if direct application configuration options are limited. Regular auditing of GLPI logs can help detect unauthorized modifications post-exploitation, although prevention via software updates remains the primary remediation strategy.