CVE-2026-128078
- Source
- https://cve.org/CVERecord?id=CVE-2026-128078
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128078.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-128078
- Aliases
-
- GHSA-h34m-gqcf-25cp
- Published
- 2026-11-13T17:43:49Z
- Modified
- 2026-11-14T02:48:03Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- GLPI: Unexpected access to followups/tasks/solutions generated from templates
- Details
-
GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-284" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128078.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128078.json
- https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d
- https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9
- https://github.com/glpi-project/glpi/releases/tag/10.0.27
- https://github.com/glpi-project/glpi/releases/tag/11.0.9
- https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp
- https://nvd.nist.gov/vuln/detail/CVE-2026-128078
Affected packages
Git / github.com/glpi-project/glpi
Affected ranges
- Type
- GIT
- Repo
- https://github.com/glpi-project/glpi
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "9.5.0" }, { "fixed": "10.0.27" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "11.0.0" }, { "fixed": "11.0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "6ac884ddb085ac25459c4d30706c6ba42a7f292d" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "10.0.27", "range": [ { "fixed": "78af2c7154a6059b1eb0ac16f1c8b8386dd21634" } ], "source": "REFERENCES_TAG" }, { "original_tag": "11.0.9", "range": [ { "fixed": "2a44dd1527a1f70da48d6b484bcb7a8849a6e5fb" } ], "source": "REFERENCES_TAG" } ] }