CVE-2026-108726

MEDIUM 4.3

GLPI through 12.0.0 Missing Authorization via ajax/map.php

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

CWE	CWE-862
Vendor	glpi-project
Product	glpi
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for glpi-project glpi

Be the first to know when new medium vulnerabilities affecting glpi-project glpi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

glpi-project / GLPI

0 ≤ 12.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind03/glpi-ajax-map-missing-itemtype-authorization github.com: https://github.com/glpi-project/glpi/blob/cd812fbc82eaa8d0356d0fb650842069c1c18f4e/ajax/map.php#L44-L52 github.com: https://github.com/glpi-project/glpi vulncheck.com: https://www.vulncheck.com/advisories/glpi-through-12.0.0-missing-authorization-via-ajax-map-php

Credits

HaiND from the Post and Telecommunication Institute of Technology