CVE-2026-45801— GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
Quick assessment
Affected
glpi-project glpi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GLPI 是一款免费的资产与 IT 管理软件套件。在版本 0.72 至 10.0.26（含 10.0.26）以及 11.0.8（含 11.0.8）中，经过身份验证但权限不足的用户能够启用调试模式。受影响的“用户设置更新”功能未强制执行旨在限制调试模式激活的权限边界，导致低权限用户可越权启用调试功能。该漏洞已在版本 10.0.26 和 11.0.8 中得到修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45801
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
Source: CVE Program / CVE List V5
Vulnerability Description
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| glpi-project | glpi | >= 0.72, < 10.0.26 | - |
|
II. Public POCs for CVE-2026-45801
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45801
请登录查看更多情报信息。
Other References for CVE-2026-45801 (5)
-
https://github.com/glpi-project/glpi/releases/tag/11.0.8 x_refsource_MISC
-
https://github.com/glpi-project/glpi/releases/tag/10.0.26 x_refsource_MISC
-
https://github.com/glpi-project/glpi/security/advisories/GHSA-3vhr-7p54-cqhw x_refsource_CONFIRM
Same Patch Batch · glpi-project · 2026-09-25 · 13 CVEs total
| CVE-2026-48482 | 9.4 CRITICAL | GLPI: RCE via Form import |
| CVE-2026-47679 | 8.5 HIGH | GLPI: arbitrary file deletion |
| CVE-2026-55214 | 8.5 HIGH | GLPI: Stored XSS in suppliers |
| CVE-2026-49470 | 7.7 HIGH | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Fo |
| CVE-2026-53625 | 7.5 HIGH | GLPI: Privilege Escalation via authtype API manipulation |
| CVE-2026-53610 | 7.5 HIGH | GLPI: Reflected XSS in dashboards |
| CVE-2026-53629 | 7.1 HIGH | GLPI: SQL injection in history tab |
| CVE-2026-53626 | 7.1 HIGH | GLPI: Arbitrary Document Read via Form Context Authorization Bypass |
| CVE-2026-53627 | 6.0 MEDIUM | GLPI: Unexpected access to update operations through the API |
| CVE-2026-53628 | 5.9 MEDIUM | GLPI: Unallowed authentication method update by administrator |
| CVE-2026-55217 | 5.3 MEDIUM | GLPI: Unallowed modfication of knowbase items comments and translations |
| CVE-2026-49469 | 4.6 MEDIUM | GLPI: LDAP filter injection in user import feature |
IV. Related Vulnerabilities
Same product: glpi
Same vendor: glpi-project
Same weakness: CWE-269
-
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass -
CVE-2026-77203
Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Esca -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100620
Capgo CLI through 7.98.2 Excessive Permissions via Overpermi -
CVE-2026-100615
Cap-go capgo.app before 12.267.1 Privilege Escalation via AP
V. Comments for CVE-2026-45801
No comments yet