CVE-2026-128078
GLPI: Unexpected access to followups/tasks/solutions generated from templates
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.
| CWE | CWE-284 |
| Vendor | glpi-project |
| Product | glpi |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for glpi-project glpi
Be the first to know when new unknown vulnerabilities affecting glpi-project glpi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
glpi-project / glpi
>= 9.5.0, < 10.0.27 >= 11.0.0, < 11.0.9
References
github.com: https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp github.com: https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d github.com: https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9 github.com: https://github.com/glpi-project/glpi/releases/tag/10.0.27 github.com: https://github.com/glpi-project/glpi/releases/tag/11.0.9