CVE-2026-45801

Deferred Deferred - Pending Action

Authenticated Debug Mode Activation in GLPI

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-45801

EUVD

EUVD-2026-87274

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	From 0.72 (inc) to 10.0.26 (inc)
glpi	glpi	11.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows an authenticated user without proper permissions to enable debug mode. The issue occurs because the user-setting update does not enforce the privilege boundary meant to restrict debug-mode activation.

Detection Guidance

Check GLPI versions between 0.72 and 10.0.26 or 11.0.8 for debug mode enabled by unauthorized users. Inspect user settings for unexpected debug mode activation without proper permissions.

Impact Analysis

An attacker could exploit this to enable debug mode, potentially exposing sensitive system information or allowing further unauthorized actions. This could lead to data leaks or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating compliance requirements for data protection and security in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or 10.0.26 immediately. Review user permissions to ensure only authorized users can enable debug mode. Monitor system logs for unauthorized debug mode changes.

Hi! I’m here to help you understand CVE-2026-45801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70