Executive brief
GLPI is an open-source IT asset management and service desk platform used to track hardware, software, and support tickets. A security flaw allows users with basic technician access to the planning module to delete any object within the system, regardless of their actual permissions. This could lead to the permanent loss of critical asset records, support history, or configuration data, disrupting IT operations and data integrity.
Technical details
A missing authorization vulnerability (CWE-862) exists in the planning component of GLPI. The root cause is an insufficient permission check that allows a technician-level user with access to the planning interface to trigger the deletion of arbitrary objects across the platform. This is a network-reachable attack requiring high privileges (specifically, access to the planning module). Successful exploitation results in a high impact on integrity and availability as an attacker can remove any managed object. The issue is resolved in versions 10.0.25 and 11.0.7; a temporary workaround is to disable delete rights within the User's planning settings.
Affected products
- glpi-project GLPI >= 9.5.0, < 10.0.25; >= 11.0.0, < 11.0.7
Timeline
- 2026-06-01: advisory: GitHub Security Advisory published by vendor
- 2026-06-03: disclosed: NVD publication date