Is CVE-2026-32312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32312 being exploited in the wild.

How severe is CVE-2026-32312?

Informational severity, with a CVSS score of 5.1, published 19 May 2026.

Which products and versions are affected?

GLPI Project GLPI 11.0.0 through 11.0.6.

Is there a fix for CVE-2026-32312?

A patch was published on 2026-04-29: Version 11.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32312 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32312?

Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32312: GLPI missing authorization in form structure export

CVE-2026-32312 · Severity: info · CVSS 5.1 · Published 2026-05-19

GLPI is an open-source IT asset management and service desk platform used by organizations to track hardware, software, and support tickets. A security flaw in certain versions allows authorized users to export the internal structure of forms they are not supposed to access. While this does not expose user data directly, it reveals how internal forms are built, which could be used to plan more sophisticated attacks or bypass business logic.

Technologies: GLPI Project GLPI. Vendors: GLPI Project.

Quick answers

Is CVE-2026-32312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32312 being exploited in the wild.
How severe is CVE-2026-32312?: Informational severity, with a CVSS score of 5.1, published 19 May 2026.
Which products and versions are affected?: GLPI Project GLPI 11.0.0 through 11.0.6.
Is there a fix for CVE-2026-32312?: A patch was published on 2026-04-29: Version 11.0.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32312 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32312?: Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in GLPI versions 11.0.0 through 11.0.6. The flaw allows an authenticated user who has been granted 'READ' permissions for forms to bypass intended access controls and export the configuration/structure of forms they are not authorized to view. The attack is carried out over the network and requires high privileges (PR:H) but no user interaction. This exposure results in a loss of confidentiality regarding the system's internal form architecture. The issue is resolved in GLPI version 11.0.7.

Affected products

GLPI Project GLPI 11.0.0 through 11.0.6

Timeline

2026-04-29: patched: Version 11.0.7 released
2026-05-18: advisory: GitHub Security Advisory published
2026-05-19: disclosed: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.