{"id":"CVE-2026-47678","kind":"vulnerability","aliases":["CVE-2026-47678"],"related":[],"title":"GLPI: authenticated users can inject SQL through dropdown endpoint","description":"GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.","summary":"GLPI is an open-source asset and IT management application. Any logged-in user can send crafted values to its dropdown fetching endpoint, which are placed into a database query, letting an attacker read or change database data.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["glpi","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed GLPI version in the admin interface or in the `version` file of the GLPI install\n- Versions from 9.4.0 up to but not including `10.0.26` and `11.0.8` are affected\n- Note whether any user accounts can log in, since authentication is required","fix":"- GLPI `11.0.8` for the 11.x line\n- GLPI `10.0.26` for the 10.x line","status":"open","published_at":"2026-11-04T23:17:34+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:47+00:00","updated_at":"2026-11-05T00:31:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T00:31:47Z","model":"claude-haiku-5-5","output":{"fix":"- GLPI `11.0.8` for the 11.x line\n- GLPI `10.0.26` for the 10.x line","reach":"network","title":"GLPI: authenticated users can inject SQL through dropdown endpoint","impact":"high","summary":"GLPI is an open-source asset and IT management application. Any logged-in user can send crafted values to its dropdown fetching endpoint, which are placed into a database query, letting an attacker read or change database data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glpi","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or alters database contents","analyst_note":"","how_to_check":"- Check the installed GLPI version in the admin interface or in the `version` file of the GLPI install\n- Versions from 9.4.0 up to but not including `10.0.26` and `11.0.8` are affected\n- Note whether any user accounts can log in, since authentication is required","plain_action":"","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Any GLPI instance from 9.4.0 up to the fixed versions is exposed, as long as at least one user can log in to it. Because the flaw is in the dropdown endpoint that the web interface calls, any authenticated account, including low-privilege ones, can reach it. Instances that are not reachable by any user account are lower risk but should still be upgraded.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4293,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-47678':12A,15A '10.0.26':75C,114C '11.0.8':77C,112C '9.4.0':73C 'applic':32B 'asset':28B,66C 'attack':56B 'authent':2A,79C 'chang':59B 'craft':40B,83C 'cve':10A,13A 'data':61B 'databas':52B,60B,96C 'dropdown':8A,44B,87C,104C 'endpoint':9A,46B,90C,105C 'fetch':45B,89C 'fix':109C 'free':65C 'glpi':1A,16B,22B,62C 'host':21B 'incorpor':93C 'inject':5A,101C 'issu':107C 'let':54B 'log':35B 'logged-in':34B 'manag':31B,69C 'open':26B 'open-sourc':25B 'packag':17B,71C 'permit':99C 'php':18B 'place':49B 'queri':53B,97C 'read':57B 'self':20B 'self-host':19B 'send':39B 'softwar':70C 'sourc':27B 'sql':6A,100C 'submit':82C 'user':3A,37B,80C 'valu':41B,84C,88C 'version':111C","nicknames":[],"mitigations":[],"who_affected":"Any GLPI instance from 9.4.0 up to the fixed versions is exposed, as long as at least one user can log in to it. Because the flaw is in the dropdown endpoint that the web interface calls, any authenticated account, including low-privilege ones, can reach it. Instances that are not reachable by any user account are lower risk but should still be upgraded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["glpi","high","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-27T07:53:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-47678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47678","severity":null,"published_at":"2026-11-04T23:17:34+00:00","modified_at":"2026-11-04T23:17:35+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[{"id":71463,"url":"https://github.com/glpi-project/glpi/commit/7cffc8f59f55ad2d955123004296bf83f25ee9f2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71464,"url":"https://github.com/glpi-project/glpi/commit/c261f2d93e35b6e5d872bfd4e73d7673be69cd68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71465,"url":"https://github.com/glpi-project/glpi/releases/tag/10.0.26","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71466,"url":"https://github.com/glpi-project/glpi/releases/tag/11.0.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71467,"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-v774-5g3p-vxg2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-27T07:53:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}