CVE-2026-53628

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53628
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53628.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53628
Aliases
  • GHSA-2hf7-pw75-7wcp
Published
2026-09-25T18:28:25Z
Modified
2026-09-27T03:47:32Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
GLPI: Unallowed authentication method update by administrator
Details

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53628.json"
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
af2617ab49bceb824614623c7d37348f8205a66e
Introduced
b5cb4adb3c350521d85209d49e29e8619cdf8316
Fixed
17b6d8de504deb8fa14825a86824f0f1cac9e10d
Fixed
1056d00af818ad2a99e3009a21a9db8c724ddc53
Fixed
27cc088f2b134fdcca0643b2485c9bfcc779bc4f
Fixed
f06a790d64ea18f8ad4ba5cf8236115dd882c364
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.84"
        },
        {
            "fixed":  "10.0.26"
        },
        {
            "introduced":  "11.0.0"
        },
        {
            "fixed":  "11.0.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53628.json"