CVE-2026-52848 · Package
NO FIX YET · SEE WHAT TO DO
GLPI, a free asset and IT management application, lets an unauthenticated user use a crafted URL during login to skip the one-time-password check. An attacker who knows a valid password can therefore get into accounts without the second factor.
first public Jul 27, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted GLPI instances from 11.0.0 up to 11.0.8 that use the login form are exposed, since the flaw sits in the login phase. Instances already on 11.0.8 or later are not affected by this issue.
Not affected if no-2fa-reliance, version-11.0.8-or-later
Who cares glpi, self-hosted, two-factor-auth
version file at the install root; affected versions are 11.0.0 through 11.0.811.0.8GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.