CVE-2026-128078 · Package
NO FIX YET · SEE WHAT TO DO
GLPI is open-source IT asset and service management software. Authenticated users could read ITIL followups, tasks, or solutions created from templates without a read check on the parent ticket, problem, or change, which can reveal information from parent items they cannot otherwise read.
first public Oct 7, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Affected installs run GLPI from 9.5.0 up to, but not including, the fixed versions, and rely on ITIL templates that generate followups, tasks or solutions. Exposure depends on the template configuration and on which users have accounts; installs on fixed versions or without such templates are less exposed. unknown whether the sources list other specific configurations.
Not affected if fixed-version, no-itil-templates
Who cares glpi, itsm, self-hosted
composer.json) and compare it with the fixed versions below.10.0.2711.0.9GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.