CVE-2026-53625 glpi-project CVE debrief

Who should care

Defenders responsible for GLPI instances, particularly those using the legacy API REST interface or SSO logins, should assess exposure and apply patches. This includes IT management teams, security teams, and operators managing GLPI deployments. They should verify configurations, apply patches, and monitor for suspicious activity to mitigate potential account takeover risks.

Why it matters

CVE-2026-53625 is a high-severity vulnerability in GLPI that allows technicians to manipulate authentication methods, potentially leading to account takeover. Defenders should prioritize verifying exposure and applying patches to GLPI instances using the legacy API REST interface or SSO logins.

• Account takeover by manipulating authentication methods
• Potential unauthorized access to GLPI instances

Technical summary

CVE-2026-53625 is a vulnerability in GLPI, a free asset and IT management software package. A technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. The issue is fixed in versions 11.0.8 and 10.0.26. Defenders should assess exposure and apply patches to GLPI instances using the legacy API REST interface or SSO logins.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to GLPI instances using the legacy API REST interface or SSO logins.

Recommended defensive actions

• Verify GLPI instance configurations and versions to determine exposure.
• Apply patches to GLPI instances using the legacy API REST interface or SSO logins.
• Monitor GLPI instances for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability affects GLPI instances using the legacy API REST interface or SSO logins. Defenders should verify exposure and apply patches to GLPI instances. The CVE Program and NVD provide official records and assessments. Additional sources, such as security advisories, may offer further insights.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.