Is CVE-2026-121559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121559 being exploited in the wild.

How severe is CVE-2026-121559?

High severity, with a CVSS score of 7.2, published 3 November 2026.

Which products and versions are affected?

GLPI Project GLPI 10.0.0 before 10.0.28; 11.0.0 before 11.0.10.

Is there a fix for CVE-2026-121559?

Yes: fixed in GLPI 10.0.28, 11.0.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121559 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-121559?

Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121559: GLPI privilege escalation in account cloning

CVE-2026-121559 · Severity: high · CVSS 7.2 · Published 2026-11-03

GLPI is an open-source IT asset management system used by organizations to track hardware, software, and support tickets. A flaw in the account cloning feature allows authenticated users with a Technician profile to create a copy of a Super-Admin account under their own control, granting them complete administrative access to the system. An attacker could use this to compromise the entire IT environment managed by GLPI.

Technologies: GLPI Project GLPI. Vendors: GLPI Project.

Quick answers

Is CVE-2026-121559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121559 being exploited in the wild.
How severe is CVE-2026-121559?: High severity, with a CVSS score of 7.2, published 3 November 2026.
Which products and versions are affected?: GLPI Project GLPI 10.0.0 before 10.0.28; 11.0.0 before 11.0.10.
Is there a fix for CVE-2026-121559?: Yes: fixed in GLPI 10.0.28, 11.0.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121559 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-121559?: Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GLPI 10.0.28, 11.0.10

Technical details

The User::getCloneRelations() method copies all Profile_User and Group_User assignments without performing permission validation during account cloning. An authenticated Technician can exploit this to clone a Super-Admin account, obtaining a new account with identical administrative privileges but under attacker control. This represents a privilege escalation from Technician to Super-Admin via insufficient authorization checks in the cloning logic.

Affected products

GLPI Project GLPI 10.0.0 before 10.0.28; 11.0.0 before 11.0.10

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.