CVE-2026-108726 glpi-project CVE debrief

Who should care

GLPI administrators and defenders should assess exposure and prioritize remediation to prevent potential unauthorized searches by low-privileged users. They should verify GLPI installations for vulnerability presence and restrict access to sensitive itemtypes. Defenders should also ensure proper authorization checks are in place for ajax/map.php and monitor for potential unauthorized searches by low-privileged users.

Why it matters

The missing authorization vulnerability in GLPI's ajax/map.php allows authenticated low-privileged users to search itemtypes they cannot view, potentially leading to unauthorized searches and exposure of sensitive information. Defenders should prioritize verifying and remediating this vulnerability in GLPI installations.

• Potential unauthorized searches by low-privileged users.
• Possible exposure of sensitive itemtype information.
• Need for verification of GLPI installations and remediation of the vulnerability.
• Potential impact on data confidentiality and integrity.

Technical summary

The vulnerability exists in GLPI's ajax/map.php due to a missing authorization check in the canView() function. This allows authenticated low-privileged users to search itemtypes they cannot view by submitting crafted itemtype and search criteria. The vulnerability can lead to unauthorized searches and potential exposure of sensitive information. Defenders should prioritize verifying and remediating this vulnerability in GLPI installations, focusing on restricting access to sensitive itemtypes and ensuring proper authorization checks are in place.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in GLPI installations, focusing on restricting access to sensitive itemtypes and ensuring proper authorization checks are in place.

Recommended defensive actions

• Verify GLPI installations for vulnerability presence and restrict access to sensitive itemtypes.
• Ensure proper authorization checks are in place for ajax/map.php.
• Monitor for potential unauthorized searches by low-privileged users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in GLPI's ajax/map.php. However, additional information on exploitation, impact, and remediation is limited. Defenders should verify GLPI installations for vulnerability presence and restrict access to sensitive itemtypes. The vulnerability allows authenticated low-privileged users to search itemtypes they cannot view by submitting crafted itemtype and search criteria. There is a need for verification of GLPI installations and remediation of the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.