What’s Vulnerable › Vulnerabilities

CVE-2026-108726: GLPI through 12.0.0 Missing Authorization via ajax/map.php

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-11 · updated 2026-10-13
• Weakness: CWE-862

Description

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Affected products

• glpi-project glpi: through 12.0.0

References

• https://github.com/glpi-project/glpi
• https://github.com/glpi-project/glpi/blob/cd812fbc82eaa8d0356d0fb650842069c1c18f4e/ajax/map.php#L44-L52
• https://hackmd.io/@haind03/glpi-ajax-map-missing-itemtype-authorization
• https://www.vulncheck.com/advisories/glpi-through-12.0.0-missing-authorization-via-ajax-map-php

Get alerted when CVE-2026-108726 or the next vulnerability affects your stack