Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108726— GLPI through 12.0.0 Missing Authorization via ajax/map.php

Quick assessment

Affected
glpi-project GLPI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GLPI 12.0.0 及以下版本在 文件中存在一个缺少授权检查的安全漏洞。攻击者可以通过绕过 权限验证函数，以低权限认证用户身份搜索其无权查看的项目类型。具体而言，攻击者可提交精心构造的 itemtype（项目类型）和搜索条件，例如 Contact（联系人）、Supplier（供应商）、Contract（合同）和 Budget（预算），从而获取这些项目在其所属实体范围内的匹配数量、标题及坐标信息。

CVSS 4.3 · Medium

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
glpi-project GLPI ≤ 12.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108726

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GLPI through 12.0.0 Missing Authorization via ajax/map.php
Source: CVE Program / CVE List V5
Vulnerability Description
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
glpi-project GLPI 0 ~ 12.0.0 -

II. Public POCs for CVE-2026-108726

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108726

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108726 (1)

News Coverage for CVE-2026-108726 (1)

Vendor Pages for CVE-2026-108726 (1)

IV. Related Vulnerabilities

Same product: GLPI
Same vendor: glpi-project
Same weakness: CWE-862

V. Comments for CVE-2026-108726

No comments yet

Leave a comment