In certain editions of GLPI, an administrator who holds the "Update auth and sync" or "Update auth, sync and 2FA" rights can change the authentication method for user accounts outside of the administrator’s own entity scope. This flaw allows the administrator to disable two‑factor authentication on those accounts without appropriate authorization, thereby lowering their security posture. The vulnerability is a classic example of improper privilege assignment, allowing an authorized user to perform actions that should be restricted to the target user’s scope.

The product affected is GLPI by glpi-project. Versions up to 10.0.26 and 11.0.8 inclusive are vulnerable; the issue is fixed in GLPI 10.0.26 and 11.0.8.

The CVSS score is 5.9, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely carried out through the web administration interface by an authenticated administrator with the affected permissions. Exploitation requires the attacker to exploit the lack of entity‑scoped permission checks, which is straightforward once the necessary rights are held.