CVE-2026-108726: GLPI through 12.0.0 Missing Authorization via ajax/map.php

Q: Who can exploit this issue?

An authenticated low-privileged GLPI user can exploit it. The attacker needs network access to the GLPI instance and permission to submit requests to ajax/map.php; no user interaction is required.

Q: What information can an attacker obtain?

The attacker can search item types they are not authorized to view and retrieve matching item counts, titles, and coordinates within their entities. Examples of affected item types include Contact, Supplier, Contract, and Budget.

Q: Are all GLPI deployments affected by default?

The available information identifies GLPI through version 12.0.0 as affected, but does not state whether a particular default role configuration exposes ajax/map.php to low-privileged users. Exposure depends on whether such users can authenticate to the instance and issue crafted map search requests.

Q: How can administrators check for exploitation?

Review requests to ajax/map.php from low-privileged accounts, particularly requests containing itemtype values such as Contact, Supplier, Contract, or Budget and search criteria for records the requester should not be able to view. The provided information does not identify specific log fields or indicators beyond these crafted requests.

Published Oct 11, 2026

Updated

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Affected Software

1 affected component

GLPI GLPI<=12.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privileged GLPI user can exploit it. The attacker needs network access to the GLPI instance and permission to submit requests to ajax/map.php; no user interaction is required.

What information can an attacker obtain?

The attacker can search item types they are not authorized to view and retrieve matching item counts, titles, and coordinates within their entities. Examples of affected item types include Contact, Supplier, Contract, and Budget.

Are all GLPI deployments affected by default?

The available information identifies GLPI through version 12.0.0 as affected, but does not state whether a particular default role configuration exposes ajax/map.php to low-privileged users. Exposure depends on whether such users can authenticate to the instance and issue crafted map search requests.

How can administrators check for exploitation?

Review requests to ajax/map.php from low-privileged accounts, particularly requests containing itemtype values such as Contact, Supplier, Contract, or Budget and search criteria for records the requester should not be able to view. The provided information does not identify specific log fields or indicators beyond these crafted requests.

CVE-2026-108726: GLPI through 12.0.0 Missing Authorization via ajax/map.php

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are all GLPI deployments affected by default?

How can administrators check for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Are all GLPI deployments affected by default?

How can administrators check for exploitation?