CVE-2026-53627

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53627

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53627.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53627

Aliases

GHSA-p68f-rv24-mc54

Published

2026-09-25T18:26:37Z

Modified

2026-09-27T03:47:32Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

GLPI: Unexpected access to update operations through the API

Details

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53627.json"
}

References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type

GIT

Repo

https://github.com/glpi-project/glpi

Events

Introduced

b5cb4adb3c350521d85209d49e29e8619cdf8316

Fixed

0fdd973c4bb3f203c6905a62a93512e5ca8604c0

Fixed

1056d00af818ad2a99e3009a21a9db8c724ddc53

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "11.0.0"
        },
        {
            "fixed":  "11.0.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

11.*

11.0.0

11.0.1

11.0.2

11.0.3

11.0.4

11.0.5

11.0.6

11.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53627.json"