Description
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
Published: 2026-09-25
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized LDAP data access via filter bypass
Action: Apply Patch
AI Analysis

Impact

GLPI's user import feature contains an LDAP filter injection flaw that lets users craft search criteria to bypass the default LDAP filter. This injection permits an attacker to retrieve LDAP objects that the filter was intended to exclude, thereby exposing potentially sensitive directory information. The weakness is a classic LDAP injection (CWE‑90).

Affected Systems

The vulnerability affects GLPI supplied by glpi-project. All releases from 0.70 up to and including 10.0.26 and 11.0.8 are impacted. Versions 10.0.26 and 11.0.8 contain the fix; any newer builds should similarly be considered safe.

Risk and Exploitability

The flaw requires an authenticated role with hotliner or technician privileges to submit the crafted criteria. It is not a remote code execution risk but does allow data exposure. The CVSS score of 4.6 reflects moderate severity, and no EPSS data or KEV listing is available, indicating the vulnerability is not widely exploited yet. The primary attack vector is internal authentication; attackers would need legitimate credentials to use the user import feature.

Generated by OpenCVE AI on September 25, 2026 at 19:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GLPI to version 10.0.26 or later (11.0.8 or newer) to include the fix.
  • If immediate upgrade is not possible, disable or restrict the user import feature to trusted users only until the patch is applied.
  • After applying the fix, verify that LDAP searches no longer return objects excluded by the default filter and monitor for any abnormal LDAP activity.

Generated by OpenCVE AI on September 25, 2026 at 19:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Glpi-project
Glpi-project glpi
Vendors & Products Glpi-project
Glpi-project glpi

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
Title GLPI: LDAP filter injection in user import feature
Weaknesses CWE-90
References
Metrics cvssV4_0

{'score': 4.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Glpi-project Glpi
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T18:00:54.072Z

Reserved: 2026-05-30T04:17:43.094Z

Link: CVE-2026-49469

cve-icon Vulnrichment

Updated: 2026-09-29T18:00:21.779Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T19:16:58.033

Modified: 2026-09-29T18:17:15.577

Link: CVE-2026-49469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T10:00:15Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')