CVE-2026-108726

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108726
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108726.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108726
Published
2026-10-11T12:19:35Z
Modified
2026-10-13T02:46:13Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
GLPI through 12.0.0 Missing Authorization via ajax/map.php
Details

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108726.json"
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cd812fbc82eaa8d0356d0fb650842069c1c18f4e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "12.0.0"
        },
        {
            "fixed":  "12.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.90
0.90-RC1
0.90-RC2
0.90-beta1
0.90-beta2
10.*
10.0.0-beta
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
11.*
11.0.0-alpha
11.0.0-alpha2
11.0.0-beta
11.0.0-beta2
11.0.0-beta3
11.0.0-beta4
11.0.0-beta5
11.0.0-beta6
11.0.0-beta7
11.0.0-rc1
12.*
12.0.0-rc1
12.0.0-rc2
12.0.0-rc3
9.*
9.1
9.1-RC1
9.1-RC2
9.3-beta
9.4.0
9.4.0-beta
9.4.0-rc1
9.4.0-rc2
9.4.1
9.4.1.1
9.5.0-rc1
9.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108726.json"