Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-53628GLPI: Unallowed authentication method update by administrator

Medium 5.9

In plain English

A medium-severity security flaw in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 0.84, < 10.0.26>= 11.0.0, < 11.0.8

Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/27cc088f2b134fdcca0643b2485c9bfcc779bc4f x_refsource_MISC
https://github.com/glpi-project/glpi/commit/f06a790d64ea18f8ad4ba5cf8236115dd882c364 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/10.0.26 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/11.0.8 x_refsource_MISC