CVE-2026-121559
Deferred Deferred - Pending Action

Privilege Escalation in GLPI via Account Cloning

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121559
EUVD
EUVD-2026-115904

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
glpi-project GLPI 10.0.0
glpi-project GLPI 11.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121559 is a privilege escalation vulnerability in GLPI versions 10.0.0 to 10.0.27 and 11.0.0 to 11.0.9. It allows authenticated users with the Technician profile to clone a Super-Admin account and create a new account with Super-Admin privileges. This occurs because the User::getCloneRelations() function copies all Profile_User and Group_User assignments without permission checks.

Detection Guidance

Check GLPI versions to identify if your system is vulnerable. Run: grep -r '"version"' /var/www/html/glpi/config/ or check the version in the GLPI web interface. If running 10.0.0-10.0.27 or 11.0.0-11.0.9, the system is vulnerable.

Impact Analysis

An attacker with Technician privileges could exploit this to gain unauthorized Super-Admin access. This allows full control over the GLPI system, including managing users, assets, and configurations. The attack requires network access but no user interaction and has low complexity.

Mitigation Strategies

Upgrade GLPI to patched versions 10.0.28 or 11.0.10 immediately. Apply the security patches from commits d30faa5 or 10a827c if upgrading is not immediately possible. Review user accounts for unauthorized Super-Admin clones created via the cloning feature.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...