CVE-2026-49469CWE-90

CVE-2026-49469

published September 25, 2026

CVSS
4.6
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.

The record
Technical detail
CVSS
4.6 · NONE
CVSS v4.0
4.6 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-09-25T23:16Z
References (5)
https://github.com/glpi-project/glpi/commit/4fb3056bcd292b515acce96887f1376ce6d5aba8 · [email protected]https://github.com/glpi-project/glpi/commit/d413b48ea97b2f73ba30c90ae0d029aac860f71a · [email protected]https://github.com/glpi-project/glpi/releases/tag/10.0.26 · [email protected]https://github.com/glpi-project/glpi/releases/tag/11.0.8 · [email protected]https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf · [email protected]
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:25Z
    GLPI: LDAP filter injection in user import feature
    cvelistv5