Medium severity · published Sep 25, 2026
CVE-2026-55217
GLPI: Unallowed modfication of knowbase items comments and translations
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi · glpi-project
>= 0.85, < 10.0.26; >= 11.0.0, < 11.0.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55217
github.com
https://github.com/glpi-project/glpi/commit/1cbf69b99dfd0610f1c03a3f245f3b248e1bfde0
github.com
https://github.com/glpi-project/glpi/commit/9c29f25bd09eca9e62ca50c52b3ebd15b02997b2
github.com
https://github.com/glpi-project/glpi/releases/tag/10.0.26
github.com
https://github.com/glpi-project/glpi/releases/tag/11.0.8
github.com
https://github.com/glpi-project/glpi/security/advisories/GHSA-xm3v-3g6q-g9q8
More from glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI allows unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-21619
GLPI allows SQL injection through the rules configuration