GHSA-c46f-4v9j-5gpc: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every ProfileUser and GroupUser assignment without permission checks, yielding an attacker-controlled Super-Admin account.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the Technician profile can exploit the issue. The attack does not require user interaction and can be performed remotely over the network.
What access does an attacker gain after successful exploitation?
The attacker can clone a Super-Admin account while setting a login and password they control. Because the clone inherits Profile_User and Group_User assignments, this yields an attacker-controlled Super-Admin account.
Which GLPI versions are affected?
Affected releases are GLPI 10.0.0 through versions before 10.0.28, and GLPI 11.0.0 through versions before 11.0.10.
How can I identify whether this vulnerability may already have been exploited?
Review account-cloning activity and look for newly created accounts with Super-Admin profiles, particularly accounts created by users assigned the Technician profile. Investigate unexpected Profile_User and Group_User assignments associated with cloned accounts.