CVE-2026-53628CWE-285

CVE-2026-53628

published September 25, 2026

CVSS
5.9
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

The record
Technical detail
CVSS
5.9 · NONE
CVSS v4.0
5.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-09-25T23:17Z
References (5)
https://github.com/glpi-project/glpi/commit/27cc088f2b134fdcca0643b2485c9bfcc779bc4f · [email protected]https://github.com/glpi-project/glpi/commit/f06a790d64ea18f8ad4ba5cf8236115dd882c364 · [email protected]https://github.com/glpi-project/glpi/releases/tag/10.0.26 · [email protected]https://github.com/glpi-project/glpi/releases/tag/11.0.8 · [email protected]https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp · [email protected]
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:28Z
    GLPI: Unallowed authentication method update by administrator
    cvelistv5