Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-52848— GLPI: MFA bypass

Quick assessment

Affected

glpi-project glpi

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GLPI 是一款免费的资产与 IT 管理软件套件。在 11.0.0 至 11.0.8 版本中，登录阶段存在漏洞：未认证用户可通过构造特定 URL 绕过一次性密码验证，从而规避双因素认证。该问题已在 11.0.8 版本中修复。

CVSS 9.2 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1110.004 · Credential Stuffing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GLPI: MFA bypass

Source: CVE Program / CVE List V5

Vulnerability Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用候选路径或通道进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
glpi-project	glpi	>= 11.0.0, < 11.0.8	-

II. Public POCs for CVE-2026-52848

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-52848

请登录查看更多情报信息。

Vendor Pages for CVE-2026-52848 (1)

🔗 Release 11.0.8 · glpi-project/glpi · GitHub Read full article x_refsource_MISC

Other References for CVE-2026-52848 (2)

https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-52848

Same Patch Batch · glpi-project · 2026-11-04 · 4 CVEs total

CVE-2026-47678	8.7 HIGH	GLPI: Blind Time based SQLI in dropdowns
CVE-2026-57152	7.1 HIGH	GLPI: Unallowed notifications sending
CVE-2026-53631	5.3 MEDIUM	GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

IV. Related Vulnerabilities

Same product: glpi

Same vendor: glpi-project

Same weakness: CWE-288