CVE-2021-21326: 
GLPI vulnerability analysis and mitigation

GLPI, an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing, was found to contain a security vulnerability (CVE-2021-21326) that allowed users to create tickets for another user with self-service interface without delegatee systems enabled. This vulnerability was discovered in versions before 9.5.4 and was disclosed on March 2, 2021 (GLPI Advisory).

The vulnerability is classified as a Horizontal Privilege Escalation issue with a CVSS v3.1 Base Score of 6.5 (Medium). The attack vector is Network-based, with Low attack complexity, requiring Low privileges and No user interaction. The scope is Unchanged, with No impact on Confidentiality, High impact on Integrity, and No impact on Availability (AttackerKB).

The vulnerability allows authenticated users to bypass authorization controls and create tickets on behalf of other users in the system, even when the delegatee system is not enabled. This could lead to unauthorized ticket creation and potential impersonation of other users within the GLPI system (GLPI Advisory).

The vulnerability has been assessed with Very High exploitability according to security researchers. It requires low privileges and can be exploited through network access, making it relatively straightforward to exploit for authenticated users (AttackerKB).

The vulnerability was fixed in GLPI version 9.5.4. Organizations using affected versions should upgrade to version 9.5.4 or later to address this security issue (GLPI Release).