High severity · published Jun 3, 2026
CVE-2026-42318
GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint
7.0
CVSS
0.3%
EPSS
No
On KEV
Description
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi · glpi-project
>= 11.0.0, < 11.0.7; >= 9.5.0, < 10.0.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42318
github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-w7mr-3vwm-2j22
vokecyber.com
https://vokecyber.com/research/cve-2026-42318-glpi-arbitrary-deletion
More from glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI is a free asset and IT management software package
9.8
CVE-2025-21619
GLPI is a free asset and IT management software package