CVE-2023-41326: 
GLPI vulnerability analysis and mitigation

CVE-2023-41326 is a security vulnerability affecting GLPI (Gestionnaire Libre de Parc Informatique), a Free Asset and IT Management Software package. The vulnerability was disclosed on September 26, 2023, affecting versions 9.5.0 and above. The issue allows a logged user from any profile to hijack the Kanban feature to alter any user field, potentially leading to account theft (GitHub Advisory, NVD).

The vulnerability is classified as a privilege management issue (CWE-269) with a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability allows authenticated users to manipulate the Kanban feature to modify user fields beyond their authorized access level (NVD).

The vulnerability enables authenticated users to potentially take over any user account in the system by manipulating user fields through the Kanban feature. This could lead to unauthorized access to sensitive information and system controls (GitHub Advisory).

Users are advised to upgrade to GLPI version 10.0.10, which contains the security patch for this vulnerability. There are no known workarounds for this vulnerability (GitHub Advisory).