CVE-2026-53625

Deferred Deferred - Pending Action

Authentication Method Change in GLPI Leading to Account Takeover

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-53625

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	to 10.0.26 (inc)
glpi	glpi	to 11.0.8 (inc)
glpi	glpi	From 0.70 (inc) to 10.0.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows a technician with API access to manipulate the authtype value and change another user's authentication method. It specifically affects versions from 0.70 to 10.0.26 and 11.0.8. Under certain configurations like legacy API REST or SSO logins, this can change a super-administrator's authentication method, leading to account takeover.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over a super-administrator's account by changing their authentication method. This could grant full control over the GLPI system, enabling unauthorized access to sensitive data, system modifications, or further attacks within the IT environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, or loss of audit integrity, potentially leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or 10.0.26 or later to address the vulnerability. Disable the legacy API REST interface or SSO logins if not required. Review user authentication methods for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-53625. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70