PT-2026-45957 · Glpi · Glpi

Louissanchez-Vokecyber · CVE-2026-42318 · Published 2026-06-03 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GLPI versions 9.5.0 through 10.0.24 GLPI versions 9.5.0 through 11.0.6

Description Low privilege users with access to planning can delete any object within the software.

Recommendations Upgrade to version 10.0.25. Upgrade to version 11.0.7. As a workaround, disable delete rights for User's planning.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-42318

GHSA-W7MR-3VWM-2J22

Affected Products

Glpi

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42318.json · Exploit
• https://ubuntu.com/security/CVE-2026-42318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42318 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-42318 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42318 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42318 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-w7mr-3vwm-2j22 · Note