Medium severity · published Sep 25, 2026
CVE-2026-53627
GLPI: Unexpected access to update operations through the API
6.0
CVSS
0.3%
EPSS
No
On KEV
Description
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi · glpi-project
>= 11.0.0, < 11.0.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53627
github.com
https://github.com/glpi-project/glpi/commit/0fdd973c4bb3f203c6905a62a93512e5ca8604c0
github.com
https://github.com/glpi-project/glpi/releases/tag/11.0.8
github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-p68f-rv24-mc54
More from glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI is a free asset and IT management software package
9.8
CVE-2025-21619
GLPI is a free asset and IT management software package