UBUNTU-CVE-2026-52848: Critical severity ubuntu/glpi vulnerability

Published Nov 5, 2026

Updated

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Affected Software

1 affected component

ubuntu/glpi*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8

Event History

Nov 5, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

GLPI versions from 11.0.0 through 11.0.8 are affected. The issue occurs during login and can be reached remotely over the network.

What does an attacker need to exploit this issue?

An unauthenticated attacker needs to use a crafted URL during the login process. No prior account privileges or user interaction are required according to the provided vector.

Does this affect two-factor authentication?

Yes. Successful exploitation skips one-time-password verification during login, defeating the affected two-factor authentication check.

What is the remediation?

Update GLPI to the fixed version identified in the advisory. The provided information states that version 11.0.8 fixes the issue.

UBUNTU-CVE-2026-52848: Critical severity ubuntu/glpi vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Does this affect two-factor authentication?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Does this affect two-factor authentication?

What is the remediation?