---
id: "CVE-2026-128078"
page: "https://infrastack.ai/live/CVE-2026-128078"
kind: "vulnerability"
aliases: ["CVE-2026-128078"]
title: "GLPI: template-generated ITIL items expose parent ticket data to users"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["glpi", "itsm", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-itil-templates"]
published_at: "2026-11-13T18:17:37+00:00"
first_seen_at: "2026-11-13T18:49:29+00:00"
updated_at: "2026-11-13T18:52:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128078", "first_seen_at": "2026-11-13T18:49:29+00:00"}]
exploit_sources: []
---

# GLPI: template-generated ITIL items expose parent ticket data to users

Link for people: https://infrastack.ai/live/CVE-2026-128078 (this .md is for agents)

GLPI is open-source IT asset and service management software. Authenticated users could read ITIL followups, tasks, or solutions created from templates without a read check on the parent ticket, problem, or change, which can reveal information from parent items they cannot otherwise read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GLPI version (for example in the web footer or `composer.json`) and compare it with the fixed versions below.
- Review whether ITIL followup, task or solution templates are used and whether they pull in parent ticket fields.

## Fix

- GLPI 10.x: move to `10.0.27`
- GLPI 11.x: move to `11.0.9`

## Timeline

- 2026-11-13T18:49:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128078

## Documents

- [advisory] Vendor advisory: github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp
- [fix] Patch: github.com https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d
- [fix] Patch: github.com https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9
- [fix] Release notes: github.com https://github.com/glpi-project/glpi/releases/tag/10.0.27
- [fix] Release notes: github.com https://github.com/glpi-project/glpi/releases/tag/11.0.9

## From the sources

GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_