CVE-2026-121559

Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.27 GLPI versions 11.0.0 through 11.0.9

Description Authenticated users can achieve privilege escalation by cloning accounts. A user with a Technician profile can clone a Super-Admin account by providing a new login and password. This occurs because the getCloneRelations() function in the User class copies all Profile User and Group User assignments without performing necessary permission checks, resulting in an account with Super-Admin privileges controlled by the attacker.

Recommendations Update GLPI versions 10.0.0 through 10.0.27 to version 10.0.28. Update GLPI versions 11.0.0 through 11.0.9 to version 11.0.10.