CVE-2026-42318

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42318
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42318.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42318
Aliases
  • GHSA-w7mr-3vwm-2j22
Downstream
Published
2026-06-03T15:17:16.756Z
Modified
2026-07-08T08:13:08.886686Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint
Details

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42318.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
b5cb4adb3c350521d85209d49e29e8619cdf8316
Fixed
0ea900cb51a37f313c733b2024bf62f6a295c271
Introduced
9fa6de558a9987561b80afd57a796a3fa19deee6
Fixed
d91722c60d7552ae96c79774793bf45d78eb9771
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.7"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "10.0.25"
        }
    ]
}

Affected versions

11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42318.json"