CVE-2026-49470 glpi-project CVE debrief

Who should care

Defenders responsible for GLPI deployments, particularly those using versions 11.0.0 through 11.0.7, should assess exposure and prioritize verification and upgrading to version 11.0.8.

Why it matters

CVE-2026-49470 allows attackers to brute-force the second factor in GLPI deployments, potentially leading to account takeover. Defenders should verify and upgrade to version 11.0.8, monitor for suspicious MFA attempts, and review incident response plans.

• Brute-force compromise of the second factor
• Potential account takeover for users with weak or compromised primary authentication credentials
• Increased risk of lateral movement within GLPI deployments
• Need for verification of GLPI version and MFA configuration

Technical summary

The GLPI time-based one-time password verification endpoint does not limit failed submissions per user, allowing an attacker with obtained primary authentication credentials to repeatedly submit TOTP values, potentially leading to brute-force compromise of the second factor and account takeover. This vulnerability affects GLPI versions 11.0.0 through 11.0.7 and is fixed in version 11.0.8. Defenders should prioritize verifying and upgrading to version 11.0.8 and implement additional monitoring for suspicious MFA verification attempts.

Defensive priority

Defenders should prioritize verifying and upgrading to version 11.0.8 if using GLPI versions 11.0.0 through 11.0.7, and implement additional monitoring for suspicious MFA verification attempts.

Recommended defensive actions

• Verify and upgrade to GLPI version 11.0.8 if using versions 11.0.0 through 11.0.7
• Implement additional monitoring for suspicious MFA verification attempts
• Review and update incident response plans to address potential account takeover
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, there is limited information on known exploitation or affected deployments. Defenders should verify GLPI version and MFA configuration, monitor for suspicious MFA attempts, and review incident response plans. The CVE Program record and NVD detail page offer source-provided metadata and vulnerability assessment. Additional verification tasks are necessary due to limited source detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.