CVE-2024-47761 Overview
CVE-2024-47761 affects GLPI, an open-source asset and IT management software package. The vulnerability exists in versions from 0.80 up to but not including 10.0.17. An administrator with access to sent notification contents can leverage exposed data to take control of an account with higher privileges. The issue maps to [CWE-287] Improper Authentication. GLPI version 10.0.17 contains the patch for this weakness.
Critical Impact
An authenticated administrator can read sensitive notification contents and escalate to a higher-privileged account, breaking the intended separation between administrator roles and super-admin accounts.
Affected Products
- GLPI versions 0.80 through 10.0.16
- GLPI Project glpi component
- Deployments where administrators retain access to sent notification logs
Discovery Timeline
- 2024-12-11 - CVE-2024-47761 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47761
Vulnerability Analysis
GLPI stores the contents of notifications sent to users for auditing and troubleshooting. Administrators can view these historical notifications through the standard interface. The problem is that certain notifications contain material that authenticates or reauthenticates a target user, such as password reset tokens or initial account credentials. An administrator with lower privileges can read a notification addressed to a higher-privileged account and reuse its embedded token to authenticate as that account.
The flaw is a scope violation. Notification content originally intended for a recipient is exposed to any user with the notification-history permission. Because GLPI's role model assumes administrators are trusted for their scope but not for cross-account authentication material, exposure of these tokens breaks the privilege boundary.
Root Cause
The root cause is insufficient access control over sensitive fields inside notification records. Notification logs retain authentication-bearing data, such as password reset links and account activation tokens, without redaction or scoping to the original recipient. The classification under [CWE-287] reflects that the reuse of these tokens by a non-recipient constitutes an authentication bypass rather than a simple information disclosure.
Attack Vector
The attacker must already hold an administrator account within GLPI. From the notifications interface, the attacker locates a message directed to a super-admin or higher-privileged user containing a password reset link or credential. The attacker then follows the link or replays the token against the login flow to gain control of that account. See the GitHub Security Advisory GHSA-x794-564w-vgxx for vendor detail.
Detection Methods for CVE-2024-47761
Indicators of Compromise
- Access to the notification history view by administrators who do not routinely audit outbound mail.
- Password reset or account activation notifications addressed to super-admin accounts that were consumed from an unexpected IP address or session.
- Successful logins to privileged accounts immediately following a password reset event initiated by another administrator.
Detection Strategies
- Correlate GLPI audit log entries for notification-history access with subsequent password reset completions and privileged logins.
- Alert when a password reset link generated for one user is consumed from a session belonging to a different user.
- Baseline which administrators normally access the notifications module and flag deviations.
Monitoring Recommendations
- Forward GLPI application logs and web server access logs to a centralized log store for retention and query.
- Monitor for authentication events on accounts holding the super-admin profile, especially outside business hours.
- Track changes to profile assignments and email addresses on privileged accounts.
How to Mitigate CVE-2024-47761
Immediate Actions Required
- Upgrade all GLPI instances to version 10.0.17 or later without delay.
- Review the notification history for password reset and credential notifications sent to privileged accounts and rotate affected credentials.
- Audit administrator account membership and remove standing administrator rights that are not required.
Patch Information
The vendor released the fix in GLPI 10.0.17. Download details are available on the GitHub GLPI Release 10.0.17 page. Full technical context is documented in the GitHub Security Advisory GHSA-x794-564w-vgxx.
Workarounds
- Restrict the config and notification-viewing rights so that only a minimum set of trusted operators can read notification contents.
- Purge historical notifications that contain reset tokens or credentials from the database until the upgrade is applied.
- Shorten the validity window of password reset tokens through GLPI configuration to reduce the replay window.
# Upgrade GLPI to the patched release
cd /var/www/glpi
php bin/console glpi:maintenance:enable
wget https://github.com/glpi-project/glpi/releases/download/10.0.17/glpi-10.0.17.tgz
tar -xzf glpi-10.0.17.tgz -C /var/www/ --overwrite
php bin/console db:update
php bin/console glpi:maintenance:disable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
