CVE-2026-45801: GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 10.0.26
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GLPI user can exploit it even if they do not have the permission intended to allow debug-mode activation.
Which installations are affected?
GLPI versions from 0.72 through versions before 10.0.26 and 11.0.8 are affected. The issue is fixed in 10.0.26 and 11.0.8.
How can I determine whether my instance is exposed?
Check the deployed GLPI version and whether authenticated users without the relevant debug-mode permission can update their user settings to enable debug mode.