CVE-2026-108726: GLPI through 12.0.0 Missing Authorization via ajax/map.php
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged GLPI user can exploit it. The attacker needs network access to the GLPI instance and permission to submit requests to ajax/map.php; no user interaction is required.
What information can an attacker obtain?
The attacker can search item types they are not authorized to view and retrieve matching item counts, titles, and coordinates within their entities. Examples of affected item types include Contact, Supplier, Contract, and Budget.
Are all GLPI deployments affected by default?
The available information identifies GLPI through version 12.0.0 as affected, but does not state whether a particular default role configuration exposes ajax/map.php to low-privileged users. Exposure depends on whether such users can authenticate to the instance and issue crafted map search requests.
How can administrators check for exploitation?
Review requests to ajax/map.php from low-privileged accounts, particularly requests containing itemtype values such as Contact, Supplier, Contract, or Budget and search criteria for records the requester should not be able to view. The provided information does not identify specific log fields or indicators beyond these crafted requests.