PT-2026-6181 · Glpi+1 · Glpi+1

Silhusk · Published 2026-02-04 · Updated 2026-03-19 · CVE-2026-23624

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 0.71 through 10.0.22 GLPI versions 0.71 through 11.0.4

Description GLPI is an asset and IT management software package. When remote authentication is used with Single Sign-On (SSO) variables, a user can potentially gain access to another user's existing GLPI session on the same machine.

Recommendations Update GLPI to version 10.0.23 or later. Update GLPI to version 11.0.5 or later.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2026-05699

CVE-2026-23624

GHSA-5J4J-VX46-R477

Affected Products

Glpi

Red Os

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23624.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05699 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23624 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23624 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23624 · Security Note
• https://ubuntu.com/security/CVE-2026-23624 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23624 · Vendor Advisory
• https://github.com/glpi-project/glpi/releases/tag/10.0.23 · Note
• https://github.com/glpi-project/glpi/releases/tag/11.0.5 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2026-23624-7.3 · Note
• https://twitter.com/CVEnew/status/2019110898368147579 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2026-23624-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-23624 · Note