CVE-2026-42318 Overview
GLPI is a free, open-source asset and IT management software package used by organizations to track inventory, tickets, and IT operations. CVE-2026-42318 is a missing authorization vulnerability [CWE-862] affecting GLPI versions 9.5.0 through 10.0.24 and 11.0.0 through 11.0.6. Low-privilege users with access to the planning feature can delete any object stored in GLPI. The flaw enables unauthorized destructive actions against tickets, assets, and other records without administrative rights. GLPI maintainers released fixed versions 10.0.25 and 11.0.7 to address the issue.
Critical Impact
Authenticated low-privilege users with planning access can delete arbitrary objects across the GLPI instance, including assets, tickets, and configuration records.
Affected Products
- GLPI versions 9.5.0 through 10.0.24
- GLPI versions 11.0.0 through 11.0.6
- Patched in GLPI 10.0.25 and 11.0.7
Discovery Timeline
- 2026-06-03 - CVE-2026-42318 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-42318
Vulnerability Analysis
The vulnerability is a missing authorization weakness classified under [CWE-862]. GLPI exposes a planning module that lets users manage scheduled items such as tasks, reminders, and events. The delete operation reachable through this module does not verify whether the requesting user holds delete rights on the target object. As a result, an authenticated low-privilege account can issue delete requests against any object identifier in the system, bypassing the normal permission model that governs assets, tickets, and other entities.
Root Cause
The planning component performs the delete action without enforcing an object-level authorization check. GLPI's permission framework defines granular rights per object type, but the planning delete path trusts the caller's planning access as sufficient. The server-side handler proceeds to remove the referenced object regardless of whether the user has delete privileges on that object class.
Attack Vector
Exploitation requires an authenticated session and access to the planning feature, which is commonly granted to standard users. The attacker submits a crafted delete request through the planning interface referencing the identifier of an unrelated object. The server processes the deletion and removes the record. The attack vector is network-based, requires no user interaction, and produces an integrity and availability impact on stored data. No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the GitHub Security Advisory GHSA-w7mr-3vwm-2j22 for technical details.
Detection Methods for CVE-2026-42318
Indicators of Compromise
- Unexpected deletions of tickets, assets, or configuration items in GLPI audit logs attributed to non-administrative accounts
- Delete events sourced from the planning module targeting object types unrelated to scheduling
- Spikes in delete actions performed by users holding only basic planning rights
Detection Strategies
- Enable and review GLPI's historical logging for all delete operations, filtering on user role versus target object type
- Correlate web server access logs with deletion endpoints invoked from planning views
- Alert when a single low-privilege account performs multiple delete actions across distinct object classes
Monitoring Recommendations
- Forward GLPI application logs and web server logs to a centralized SIEM for retention and correlation
- Establish a baseline of normal delete volume per user role and trigger alerts on deviations
- Monitor database-level delete statements against core GLPI tables for activity outside maintenance windows
How to Mitigate CVE-2026-42318
Immediate Actions Required
- Upgrade GLPI to version 11.0.7 or 10.0.25 as soon as possible
- Audit user accounts and reduce planning rights to only users who require them
- Review historical logs for unauthorized deletions performed by low-privilege users
Patch Information
The GLPI project released patched versions 10.0.25 and 11.0.7 that enforce authorization checks on the planning delete path. Administrators should plan upgrades following standard GLPI release procedures, including database migration steps. Patch details are available in the GitHub Security Advisory GHSA-w7mr-3vwm-2j22.
Workarounds
- Disable delete rights for the User's planning profile until the upgrade is applied
- Restrict planning module access to a minimal set of trusted users
- Increase backup frequency to enable rapid recovery if unauthorized deletions occur
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
