CVE-2026-53627CWE-862broken-access-control

CVE-2026-53627

published September 25, 2026

CVSS
6.0
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-25T23:17Z
References (3)
https://github.com/glpi-project/glpi/commit/0fdd973c4bb3f203c6905a62a93512e5ca8604c0 · [email protected]https://github.com/glpi-project/glpi/releases/tag/11.0.8 · [email protected]https://github.com/glpi-project/glpi/security/advisories/GHSA-p68f-rv24-mc54 · [email protected]
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:26Z
    GLPI: Unexpected access to update operations through the API
    cvelistv5