CVE-2026-53628: 
GLPI vulnerability analysis and mitigation

CVE-2026-53628 is an improper authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package. It allows an administrator holding the "Update auth and sync" or "Update auth, sync and 2FA" right to change the authentication method and disable two-factor authentication (2FA) for user accounts outside their entity scope. The vulnerability affects GLPI versions from 0.84 up to (but not including) 10.0.26, and versions 11.0.0 up to (but not including) 11.0.8. It was disclosed on June 24, 2026, and patched in the same security release. It carries a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, GLPI Release 10.0.26).

The root cause is CWE-285 (Improper Authorization): the user-account administration flow in GLPI did not consistently enforce entity-scoped update permissions when processing authentication-related actions. Specifically, the front/user.form.php controller checked only the global UPDATEAUTHENT right (via Session::checkRight) before performing actions such as change_auth_method, force_ldap_resynch, clean_ldap_fields, and disable_2fa, without additionally verifying that the acting administrator had UPDATE permission on the target user's entity. The fix adds $user->check($_POST['id'], UPDATE) calls after the global right check in each affected code path, and similarly adds entity-scoped checks in Auth::showSynchronizationForm(), User::processMassiveActionsForOneItemtype(), and Group::showLDAPForm() (GitHub Commit 27cc088, GitHub Commit f06a790).

A malicious or compromised administrator can exploit this vulnerability to disable 2FA for user accounts in other organizational entities, effectively weakening the authentication security posture of those accounts without authorization. This could facilitate account takeover of higher-privileged users in other entities by removing a critical authentication control. The CVSS v4.0 assessment rates confidentiality and availability impact as High on the vulnerable system, reflecting the potential for unauthorized access to sensitive data and disruption of authentication controls (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.0045 (0.45%), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated administrator account with specific rights (UPDATEAUTHENT), limiting the attack surface (GitHub Advisory, GLPI Release 11.0.8).

1. Obtain privileged access: Authenticate to the GLPI instance as an administrator account that holds the "Update auth and sync" or "Update auth, sync and 2FA" right, but whose entity scope does not include the target user's entity.
2. Identify target user: Browse or enumerate user accounts in GLPI to identify a target user in a different entity (e.g., a higher-privileged administrator with 2FA enabled).
3. Craft a POST request: Submit a POST request to front/user.form.php with the parameter change_auth_method or disable_2fa set, along with the target user's id in $_POST['id']. In unpatched versions, only the global UPDATEAUTHENT right is checked, not the entity-scoped UPDATE permission.
4. Disable 2FA or change auth method: The server processes the request without verifying entity scope, disabling 2FA or changing the authentication method for the target user account.
5. Leverage weakened account: With 2FA disabled on the target account, the attacker (or a collaborator) can attempt credential-based attacks or use previously obtained credentials to authenticate as the target user without the 2FA barrier (GitHub Advisory, GitHub Commit f06a790).

• Logs: GLPI application logs showing POST requests to front/user.form.php with parameters change_auth_method, disable_2fa, force_ldap_resynch, or clean_ldap_fields where the acting administrator's entity does not match the target user's entity.
• Logs: Audit trail entries in GLPI showing authentication method changes or 2FA disablement for users in entities not managed by the acting administrator.
• Application Events: Unexpected changes to user authentication settings (e.g., authtype field modifications or 2fa field set to null) in the GLPI database for users outside the modifying administrator's entity scope.
• Network: Unusual POST requests to /front/user.form.php from administrator accounts that do not typically manage users in the affected entity.

Upgrade GLPI to version 10.0.26 (for the 10.x branch) or 11.0.8 (for the 11.x branch), both released on June 24, 2026, which include the fix for this vulnerability. No configuration-based workaround is available; upgrading is the only remediation. As a compensating control, administrators should audit user accounts for unexpected authentication method changes or 2FA disablement, and restrict the UPDATEAUTHENT right to only fully trusted administrators (GLPI Release 10.0.26, GLPI Release 11.0.8).

The vulnerability was reported by researcher ncl-001 and credited in the GitHub Security Advisory. The GLPI project team published the advisory and patches simultaneously on June 24, 2026, as part of a broader security release addressing multiple CVEs. No notable independent researcher commentary or significant media coverage beyond standard vulnerability database aggregation has been identified for this specific CVE (GitHub Advisory).