{"id":"CVE-2026-121559","kind":"vulnerability","aliases":["CVE-2026-121559"],"related":[],"title":"GLPI: technician accounts can clone a Super-Admin account","description":"GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.","summary":"GLPI, an IT service management web application, lets a user with the Technician profile clone an existing Super-Admin account under a new login and password. The clone copies every profile and group assignment without permission checks, so the attacker ends up with an Super-Admin account they control.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["glpi","it-service-management","package","self-hosted"],"not_affected_if":["fixed-version","no-technician-users"],"how_to_check":"- Check the installed GLPI version: `10.0.x` or `11.0.x` below the fixed versions is affected.\n- Review user accounts for unexpected clones of Super-Admin users with new logins.\n- Review which accounts have the Technician profile.","fix":"- GLPI 10.0.x: move to `10.0.28`\n- GLPI 11.0.x: move to `11.0.10`","status":"open","published_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:23:41+00:00","updated_at":"2026-11-03T16:23:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T16:23:41Z","model":"claude-haiku-5-5","output":{"fix":"- GLPI 10.0.x: move to `10.0.28`\n- GLPI 11.0.x: move to `11.0.10`","reach":"network","title":"GLPI: technician accounts can clone a Super-Admin account","impact":"high","summary":"GLPI, an IT service management web application, lets a user with the Technician profile clone an existing Super-Admin account under a new login and password. The clone copies every profile and group assignment without permission checks, so the attacker ends up with an Super-Admin account they control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glpi","self-hosted","it-service-management"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker becomes Super-Admin and controls the whole GLPI instance","analyst_note":"","how_to_check":"- Check the installed GLPI version: `10.0.x` or `11.0.x` below the fixed versions is affected.\n- Review user accounts for unexpected clones of Super-Admin users with new logins.\n- Review which accounts have the Technician profile.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-technician-users"],"who_is_affected":"Any GLPI installation on the affected version ranges where users hold the Technician profile is exposed, since that profile is the starting point. Installations where only administrators have accounts are at much lower risk. unknown whether the sources describe default-configuration exposure beyond this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4259,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121559':13A,16A '-2026':12A,15A '10.0.0':78C '10.0.28':80C '11.0.0':82C '11.0.10':84C 'account':3A,10A,46B,74B,100C,113C,142C 'admin':9A,45B,73B,112C,141C 'allow':91C 'applic':32B 'assign':60B,130C 'attack':66B,137C 'attacker-control':136C 'authent':92C 'check':63B,133C 'clone':5A,40B,54B,99C,108C 'contain':85C 'control':76B,138C 'copi':55B,123C 'cve':11A,14A 'elev':96C 'end':67B 'escal':88C 'everi':56B,124C 'exist':42B 'getclonerel':122C 'glpi':1A,17B,26B,77C 'group':59B,128C 'host':25B 'it-service-manag':18B 'let':33B 'login':50B,117C 'manag':21B,30B 'new':49B,116C 'obtain':95C 'packag':22B 'password':52B,119C 'permiss':62B,132C 'privileg':87C 'profil':39B,57B,97C,106C,125C 'self':24B 'self-host':23B 'servic':20B,29B 'sinc':120C 'super':8A,44B,72B,111C,140C 'super-admin':7A,43B,71B,110C,139C 'technician':2A,38B,105C 'user':35B,93C,102C,121C,126C,129C 'vulner':89C 'web':31B 'without':61B,131C 'yield':134C","nicknames":[],"mitigations":[],"who_affected":"Any GLPI installation on the affected version ranges where users hold the Technician profile is exposed, since that profile is the starting point. Installations where only administrators have accounts are at much lower risk. unknown whether the sources describe default-configuration exposure beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["glpi","high","itservicemanagement","package","selfhosted"],"first_public_at":"2026-11-02T13:19:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121559","severity":null,"published_at":"2026-11-03T16:17:28+00:00","modified_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58852,"url":"https://github.com/glpi-project/glpi/commit/10a827c8c1868a0a65ab977d30878ff16547d9a7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58853,"url":"https://github.com/glpi-project/glpi/commit/d30faa501e8b549ae507615b05e7d99dacfe5d98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58854,"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-c46f-4v9j-5gpc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-02T13:19:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58855,"url":"https://www.vulncheck.com/advisories/glpi-10.0.0-before-10.0.28-and-11.0.0-before-11.0.10-privilege-escalation-via-user-cloning","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}