CVE-2026-53628

Deferred Deferred - Pending Action

Authentication Method Change in GLPI

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-53628

EUVD

EUVD-2026-87275

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	to 10.0.26 (inc)
glpi	glpi	to 11.0.8 (inc)
glpi	glpi	From 0.84 (inc) to 10.0.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows an administrator with specific rights to change authentication methods and disable two-factor authentication for users outside their entity scope. The issue exists due to inconsistent enforcement of entity-scoped update permissions during user-account administration.

Detection Guidance

This vulnerability involves improper enforcement of entity-scoped update permissions in GLPI versions 0.84 to 10.0.26 and 11.0.8. To detect it, check GLPI user account settings for unauthorized changes to authentication methods or 2FA status outside the administrator's entity scope. Review logs for suspicious admin actions and verify user permissions align with their assigned entities.

Impact Analysis

An attacker with administrator privileges could exploit this to bypass security controls for users outside their scope, potentially gaining unauthorized access to sensitive accounts or systems. This could lead to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability could compromise compliance by allowing unauthorized access to sensitive data, violating principles of least privilege and data protection. It may lead to violations of GDPR's security requirements or HIPAA's access controls.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or 10.0.26 or later to address the vulnerability. Ensure administrators strictly follow entity-scoped update permissions and verify two-factor authentication settings for user accounts.

Hi! I’m here to help you understand CVE-2026-53628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70