CVE-2026-128078: GLPI: Unexpected access to followups/tasks/solutions generated from templates

Q: Who can exploit this issue?

An attacker must be authenticated to GLPI. The issue affects users who can access ITIL followups, tasks, or solutions generated from templates but do not have read permission for the associated parent ticket, problem, or change.

Q: What information could be exposed?

Depending on the template configuration, followups, tasks, or solutions generated from templates can reveal information from parent tickets, problems, or changes that the user is not otherwise allowed to read.

Q: Which GLPI versions should be remediated?

The affected range begins with GLPI 9.5.0 and includes versions before the fixes in 10.0.27 and 11.0.9. Upgrade to 10.0.27 or 11.0.9 as applicable.

Q: How can we determine whether we may be exposed?

Review whether your GLPI instance uses templates that generate ITIL followups, tasks, or solutions, and whether users without read access to the parent items can access those generated records. Template configuration determines whether parent-item information is disclosed.

Published Nov 13, 2026

Updated

GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9.

Affected Software

1 affected component

Teclib GLPI>=9.5.0<10.0.27, >=11.0.0<11.0.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.27
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.9

Event History

Nov 13, 2026

CVE Published

via MITRE·05:43 PM

Data Sourced

via MITRE·05:43 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to GLPI. The issue affects users who can access ITIL followups, tasks, or solutions generated from templates but do not have read permission for the associated parent ticket, problem, or change.

What information could be exposed?

Depending on the template configuration, followups, tasks, or solutions generated from templates can reveal information from parent tickets, problems, or changes that the user is not otherwise allowed to read.

Which GLPI versions should be remediated?

The affected range begins with GLPI 9.5.0 and includes versions before the fixes in 10.0.27 and 11.0.9. Upgrade to 10.0.27 or 11.0.9 as applicable.

How can we determine whether we may be exposed?

Review whether your GLPI instance uses templates that generate ITIL followups, tasks, or solutions, and whether users without read access to the parent items can access those generated records. Template configuration determines whether parent-item information is disclosed.

CVE-2026-128078: GLPI: Unexpected access to followups/tasks/solutions generated from templates

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which GLPI versions should be remediated?

How can we determine whether we may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which GLPI versions should be remediated?

How can we determine whether we may be exposed?