CVE-2026-55217: 
GLPI vulnerability analysis and mitigation

CVE-2026-55217 is an improper authorization vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free asset and IT management software package. It allows a low-privileged authenticated user to create, update, or delete knowledge base comments and translations without the required authorization for the affected content. The vulnerability affects GLPI versions from 0.85 up to (but not including) 10.0.26, and versions 11.0.0 up to (but not including) 11.0.8. It was published on September 25, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-285 (Improper Authorization): the application failed to perform adequate authorization checks before allowing modifications to knowledge base comments and translations. Specifically, the front-end form handlers front/knowbaseitem_comment.form.php and front/knowbaseitemtranslation.form.php did not invoke the appropriate check() method with CREATE, UPDATE, or PURGE permissions before processing POST requests, meaning any authenticated low-privileged user could submit crafted HTTP POST requests to these endpoints and manipulate knowledge base content belonging to other users or restricted items. The fix added proper $comment->check() and $translation->check() calls with the correct permission flags, and introduced granular authorization methods in KnowbaseItem_Comment.php to enforce ownership and admin-level rights (GitHub Commit 1cbf69b, GitHub Commit 9c29f25).

Successful exploitation allows a low-privileged authenticated attacker to tamper with the integrity of the GLPI knowledge base by creating, modifying, or deleting comments and translations on items they do not own or have authorization to manage. This primarily affects data integrity — an attacker could corrupt or remove critical IT documentation, insert misleading information, or erase audit trails within the knowledge base. There is no direct confidentiality or availability impact, and no evidence of lateral movement potential beyond the knowledge base content scope (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.31%, indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Authentication: Log in to a vulnerable GLPI instance (versions 0.85–10.0.25 or 11.0.0–11.0.7) with any low-privileged user account.
2. Identify target knowledge base items: Browse the GLPI knowledge base to identify articles with comments or translations that the attacker does not own or have authorization to modify.
3. Craft a malicious POST request: Using a browser or tool such as curl or Burp Suite, craft an HTTP POST request to front/knowbaseitem_comment.form.php or front/knowbaseitemtranslation.form.php with the desired action (add, update, or purge) and the target knowbaseitems_id or id parameter.
4. Submit the request: Send the POST request with a valid session cookie. Because the authorization check is missing, the server processes the request without verifying the user's rights over the target item.
5. Achieve unauthorized modification: The comment or translation is created, updated, or deleted as requested, bypassing the intended access controls (GitHub Commit 1cbf69b, GitHub Advisory).

• Logs: GLPI application logs showing POST requests to front/knowbaseitem_comment.form.php or front/knowbaseitemtranslation.form.php from low-privileged user accounts, particularly with add, update, or purge actions on knowledge base items not owned by that user.
• Database: Unexpected creation, modification, or deletion of records in the glpi_knowbaseitems_comments or glpi_knowbaseitemtranslations tables attributed to users without appropriate rights.
• GLPI Event Log: GLPI's internal event log entries showing knowledge base comment or translation changes by users who should not have had that access.

The GLPI project has released patched versions that address this vulnerability: 10.0.26 (for the 10.x branch) and 11.0.8 (for the 11.x branch). Administrators should upgrade to one of these versions as soon as possible. No configuration-based workaround is documented; upgrading is the only recommended remediation (GLPI Release 10.0.26, GLPI Release 11.0.8).

The vulnerability was reported by security researchers Mitchell45 and yavolo, and the advisory was published by GLPI maintainer cedric-anne on July 21, 2026. The fix was part of a broader security release (10.0.26 / 11.0.8) that addressed multiple medium and high severity issues, which received positive community reception on GitHub with several reactions to the release announcements (GitHub Advisory, GLPI Release 11.0.8).