CVE-2026-49469 glpi-project CVE debrief

Who should care

Defenders and administrators of GLPI installations should assess exposure and prioritize verifying and applying patches to versions 11.0.8 and 10.0.26. They should also monitor for potential unauthorized access to LDAP objects and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions

Why it matters

CVE-2026-49469 is a vulnerability in GLPI that allows authenticated users to bypass the default LDAP filter, potentially leading to unauthorized access to LDAP objects. Defenders should prioritize verifying and applying patches to versions 11.0.8 and 10.0.26, and assess exposure in their environments.

• Potential unauthorized access to LDAP objects
• Bypassing of configured default LDAP filter
• Increased risk for GLPI installations not patched

Technical summary

An authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter, allowing access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26. The vulnerability has a CVSS score of 4.6 and a severity of MEDIUM. The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed versions. Defenders should prioritize verifying and applying patches to versions 11.0.8 and 10.0.26, and assess exposure in their environments.

Defensive priority

Defenders should prioritize verifying and applying the patches to versions 11.0.8 and 10.0.26, and assess exposure in their environments.

Recommended defensive actions

• Verify and apply patches to versions 11.0.8 and 10.0.26
• Assess exposure in environments
• Monitor for potential unauthorized access to LDAP objects
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed versions. The vulnerability allows authenticated hotliners or technicians to bypass the configured default LDAP filter, potentially leading to unauthorized access to LDAP objects. Defenders should verify and apply patches to versions 11.0.8 and 10.0.26, assess exposure in their environments, and monitor for potential unauthorized access to LDAP objects. Evidence from the CVE record and NVD detail page indicates that the CVE-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.