GLPI through 12.0.0 Missing Authorization via ajax/map.php (glpi-project GLPI)

CVE-2026-108726

MEDIUM 5.3

En bref

Source: NVD
EPSS: EPSS 0.25 % · centile 17 (2026-11-01)
État: PUBLISHED
Publiée: 2026-10-11 12:19 UTC
Mise à jour: 2026-10-13 17:01 UTC
Attribuée par: VulnCheck
Statut NVD: Deferred

Rechercher sur…

Description

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Faiblesses (CWE)

CWE-862 — Autorisation absente

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	MEDIUM 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	VulnCheck
CVSS 4.0	MEDIUM 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	NVD · disclosure@vulncheck.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-96892
GCVE · GCVE-0-2026-108726

Produits affectés

Produit	Versions
glpi-project · GLPI	affected 0 ≤ 12.0.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 GLPI through 12.0.0 Missing Authorization via ajax/map.php (glpi-project GLPI)