{"id":"CVE-2026-128078","kind":"vulnerability","aliases":["CVE-2026-128078"],"related":[],"title":"GLPI: template-generated ITIL items expose parent ticket data to users","description":"GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.","summary":"GLPI is open-source IT asset and service management software. Authenticated users could read ITIL followups, tasks, or solutions created from templates without a read check on the parent ticket, problem, or change, which can reveal information from parent items they cannot otherwise read.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["glpi","itsm","package","self-hosted"],"not_affected_if":["fixed-version","no-itil-templates"],"how_to_check":"- Check the installed GLPI version (for example in the web footer or `composer.json`) and compare it with the fixed versions below.\n- Review whether ITIL followup, task or solution templates are used and whether they pull in parent ticket fields.","fix":"- GLPI 10.x: move to `10.0.27`\n- GLPI 11.x: move to `11.0.9`","status":"open","published_at":"2026-11-13T18:17:37+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:52:00+00:00","updated_at":"2026-11-13T18:52:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T18:52:00Z","model":"claude-haiku-5-5","output":{"fix":"- GLPI 10.x: move to `10.0.27`\n- GLPI 11.x: move to `11.0.9`","reach":"network","title":"GLPI: template-generated ITIL items expose parent ticket data to users","impact":"low","summary":"GLPI is open-source IT asset and service management software. Authenticated users could read ITIL followups, tasks, or solutions created from templates without a read check on the parent ticket, problem, or change, which can reveal information from parent items they cannot otherwise read.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glpi","self-hosted","itsm"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read parent ticket data they lack permission for","analyst_note":"","how_to_check":"- Check the installed GLPI version (for example in the web footer or `composer.json`) and compare it with the fixed versions below.\n- Review whether ITIL followup, task or solution templates are used and whether they pull in parent ticket fields.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-itil-templates"],"who_is_affected":"Affected installs run GLPI from 9.5.0 up to, but not including, the fixed versions, and rely on ITIL templates that generate followups, tasks or solutions. Exposure depends on the template configuration and on which users have accounts; installs on fixed versions or without such templates are less exposed. unknown whether the sources list other specific configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000745,"input_tokens":4643,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128078':15A,18A '-2026':14A,17A '10.0.27':83C,135C '11.0.9':85C,137C '9.5.0':81C 'access':89C 'asset':31B,74C 'authent':36B,86C 'cannot':67B 'chang':58B,110C 'check':51B,103C 'configur':115C 'could':38B,88C,117C,125C 'creat':45B 'cve':13A,16A 'data':10A 'depend':111C 'expos':7A 'fix':132C 'followup':41B,91C 'free':73C 'generat':4A,95C 'glpi':1A,19B,25B,70C 'host':24B 'inform':62B,119C 'issu':130C 'item':6A,65B,122C 'itil':5A,40B,90C 'itsm':20B 'manag':34B,77C 'open':28B 'open-sourc':27B 'otherwis':68B,127C 'packag':21B,79C 'parent':8A,54B,64B,106C,121C 'permiss':102C 'problem':56B,108C 'read':39B,50B,69B,101C,128C 'read-permiss':100C 'reveal':61B,118C 'self':23B 'self-host':22B 'servic':33B 'softwar':35B,78C 'solut':44B,94C 'sourc':29B 'task':42B,92C 'templat':3A,47B,97C,114C 'template-gener':2A 'ticket':9A,55B,107C 'user':12A,37B,87C,124C 'version':134C 'without':48B,98C","nicknames":[],"mitigations":[],"who_affected":"Affected installs run GLPI from 9.5.0 up to, but not including, the fixed versions, and rely on ITIL templates that generate followups, tasks or solutions. Exposure depends on the template configuration and on which users have accounts; installs on fixed versions or without such templates are less exposed. unknown whether the sources list other specific configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["glpi","itsm","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-128078':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':10A 'expos':7A 'generat':4A 'glpi':1A 'item':6A 'itil':5A 'parent':8A 'templat':3A 'template-gener':2A 'ticket':9A 'user':12A","search_b":"'asset':31B 'authent':36B 'cannot':67B 'chang':58B 'check':51B 'could':38B 'creat':45B 'followup':41B 'glpi':19B,25B 'host':24B 'inform':62B 'item':65B 'itil':40B 'itsm':20B 'manag':34B 'open':28B 'open-sourc':27B 'otherwis':68B 'packag':21B 'parent':54B,64B 'problem':56B 'read':39B,50B,69B 'reveal':61B 'self':23B 'self-host':22B 'servic':33B 'softwar':35B 'solut':44B 'sourc':29B 'task':42B 'templat':47B 'ticket':55B 'user':37B 'without':48B","search_c":"'10.0.27':83C,135C '11.0.9':85C,137C '9.5.0':81C 'access':89C 'asset':74C 'authent':86C 'chang':110C 'check':103C 'configur':115C 'could':88C,117C,125C 'depend':111C 'fix':132C 'followup':91C 'free':73C 'generat':95C 'glpi':70C 'inform':119C 'issu':130C 'item':122C 'itil':90C 'manag':77C 'otherwis':127C 'packag':79C 'parent':106C,121C 'permiss':102C 'problem':108C 'read':101C,128C 'read-permiss':100C 'reveal':118C 'softwar':78C 'solut':94C 'task':92C 'templat':97C,114C 'ticket':107C 'user':87C,124C 'version':134C 'without':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T07:57:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128078","severity":null,"published_at":"2026-11-13T18:17:37+00:00","modified_at":"2026-11-13T18:17:37+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[{"id":148594,"url":"https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148595,"url":"https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71473,"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.27","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71474,"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148598,"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T07:57:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}