CVE-2026-53627: 
GLPI vulnerability analysis and mitigation

CVE-2026-53627 is a missing authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package. It affects GLPI versions 11.0.0 through 11.0.7, and was fixed in version 11.0.8. A low-privileged authenticated user can exploit the new API (v2) to perform update operations that are normally forbidden through the user interface, due to inconsistent enforcement of authorization checks in the API update flow. The vulnerability was published on September 25, 2026, and carries a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, GLPI Release).

The root cause is classified as CWE-862 (Missing Authorization). The GLPI API v2 controllers — specifically CoreController.php and ITILController.php — failed to consistently apply authorization checks before processing update operations such as entity transfers, ITIL team member management (add/remove/read), and related actions. The fix, applied in commit 0fdd973, added explicit permission checks (e.g., Session::haveRight(), $item->can(), $item->canAssign()) at the start of the affected API handler methods. Exploitation requires network access and a valid low-privilege account, but no special configuration or user interaction beyond authentication (GitHub Advisory, Fix Commit).

Successful exploitation allows a low-privileged authenticated user to perform unauthorized data modification operations — such as transferring entities or manipulating ITIL ticket team members — that would normally be restricted by the application's role-based access controls. The primary impact is on data integrity (rated High in CVSS v4), with a minor availability impact and no direct confidentiality impact. In environments where GLPI manages IT assets, tickets, and organizational data, unauthorized modifications could disrupt IT service management workflows or enable privilege abuse within the application (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.31%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privilege account on the GLPI instance and knowledge of the API v2 endpoints, making opportunistic mass exploitation unlikely (Feedly).

1. Reconnaissance: Identify a GLPI instance running version 11.0.0–11.0.7 with the API v2 enabled. This can be done by checking the GLPI version via the web interface or API metadata endpoint.
2. Authentication: Obtain valid credentials for a low-privileged GLPI user account (e.g., a standard helpdesk user with no administrative rights).
3. Identify restricted API endpoints: Target API v2 endpoints that enforce authorization in the UI but not in the API, such as POST /Transfer (entity transfer) or POST /Assistance/Ticket/{id}/TeamMember (add team member to a ticket).
4. Craft unauthorized API request: Send an authenticated HTTP request to the target endpoint with appropriate parameters (e.g., transfer records or team member assignment data) that the user's role would normally prohibit.
5. Achieve unauthorized modification: The API processes the request without enforcing the required permission checks, resulting in unauthorized data modification such as entity reassignment or ticket team manipulation (Fix Commit, GitHub Advisory).

• Network: Unexpected API v2 requests (e.g., POST /api.php/v2/Transfer, POST /api.php/v2/Assistance/Ticket/{id}/TeamMember) originating from low-privileged user accounts.
• Logs: GLPI application logs showing API v2 update/transfer operations performed by accounts that lack the corresponding UI permissions; repeated API calls to ITIL team member or entity transfer endpoints from non-administrative users.
• Application: Unexpected changes to ticket team assignments, entity ownership, or transfer records in GLPI that do not correspond to authorized administrative actions.

The vendor has released GLPI version 11.0.8, which addresses this vulnerability by adding explicit authorization checks to the affected API v2 controller methods. Upgrading to version 11.0.8 or later is the recommended and only known remediation. No configuration-based workaround is documented; if immediate upgrade is not possible, consider restricting API v2 access at the network or application level to trusted users only (GLPI Release, GitHub Advisory).

The vulnerability was reported by a researcher credited as "byteoverride" and was disclosed via GitHub Security Advisories by GLPI maintainer cedric-anne. The GLPI project released version 11.0.8 as a security release addressing 16 CVEs simultaneously, recommending immediate upgrade. No significant broader media coverage or notable community commentary beyond the official advisory and release notes has been identified (GitHub Advisory, GLPI Release).