A technician with API access can alter the 'authtype' parameter of another user’s account, allowing the attacker to change that user’s authentication method. If the target is a super‑administrator and the configuration uses either the legacy REST interface or SSO logins, an attacker can effectively replace the manager’s authentication mechanism and assume the account. This type of manipulation leads to a full compromise of the user’s privileges and can be used for further lateral movement or data exfiltration.

The vulnerability affects GLPI asset management software made by glpi-project, in all releases from 0.70 through 10.0.26 and 11.0.8. The security fix is included in the 10.0.26 and 11.0.8 releases; earlier versions remain vulnerable.

The CVSS score of 7.5 indicates a high impact with moderate to high exploitability, but no EPSS data is available. The vulnerability is not listed in CISA KEV. Based on the description, a threat actor would need API or administrative credentials to craft the request, but the attack could be launched remotely over the network from any user with technician role who has API privileges. Once the authtype is altered, the attacker can authenticate as the target account without knowledge of the original credentials, resulting in a full account takeover. The lack of a public exploit does not diminish the seriousness of the flaw because the conditions for exploitation are common in typical GLPI deployments.