Live › vulnerability › CVE-2026-121559
GLPI, an IT service management web application, lets a user with the Technician profile clone an existing Super-Admin account under a new login and password. The clone copies every profile and group assignment without permission checks, so the attacker ends up with an Super-Admin account they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Any GLPI installation on the affected version ranges where users hold the Technician profile is exposed, since that profile is the starting point. Installations where only administrators have accounts are at much lower risk. unknown whether the sources describe default-configuration exposure beyond this.
No product ranges from the sources yet.
10.0.x or 11.0.x below the fixed versions is affected.10.0.2811.0.10Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.
This page as .md · .json · in your agent: get_signal("CVE-2026-121559")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.