CVE-2026-49469: GLPI LDAP Filter Auth Bypass Vulnerability

CVE-2026-49469 Overview

CVE-2026-49469 is an LDAP injection vulnerability in GLPI, a free asset and IT management software package. The flaw affects versions from 0.70 up to 10.0.26 and 11.0.8. An authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to Lightweight Directory Access Protocol (LDAP) objects that the default filter was intended to exclude. The issue is classified as improper neutralization of special elements used in an LDAP query [CWE-90]. Fixed releases are GLPI 10.0.26 and 11.0.8.

Critical Impact
Authenticated low-to-mid privilege users (hotliner/technician roles) can enumerate LDAP directory objects outside the administrator-defined scope, leading to information exposure of the connected directory.

Affected Products

GLPI versions 0.70 through 10.0.25
GLPI versions 11.0.0 through 11.0.7
Deployments using LDAP-based user import with a configured default filter

Discovery Timeline

2026-09-25 - CVE-2026-49469 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-49469

Vulnerability Analysis

The vulnerability resides in the user import workflow of GLPI's LDAP authentication component (src/AuthLDAP.php). When an authenticated user with the hotliner or technician profile submits import criteria, the application concatenates user-supplied values directly into the LDAP filter string. Because the input is never escaped for the LDAP filter context, special characters such as (, ), *, \, and NUL can alter the structure of the generated filter. The attacker can inject additional filter components, close the configured default filter, or widen its scope so excluded directory entries become visible in results.

Root Cause

The root cause is missing output encoding before building an LDAP filter from untrusted input. GLPI concatenates the raw $value from import criteria into a filter fragment of the form (attribute=*value*) without calling ldap_escape(). Any filter metacharacter supplied by the authenticated user is interpreted by the directory server rather than treated as literal data, which is the defining pattern of LDAP injection [CWE-90].

Attack Vector

Exploitation requires network access to the GLPI web interface and valid credentials for an account that holds the hotliner or technician profile. The attacker opens the user import feature, supplies crafted search criteria containing LDAP filter syntax, and submits the request. The server merges the injected syntax into the LDAP query and dispatches it against the directory, returning entries that the default filter was configured to hide.

php

// Patch from src/AuthLDAP.php - adds ldap_escape() around user-supplied $value
                         $value = substr($value, $begin, $length - $end - $begin);
                     }
                     $counter++;
-                    $filter .= '(' . $authldap->fields[$criteria] . '=' . ($begin ? '' : '*') . $value . ($end ? '' : '*') . ')';
+                    $filter .= '(' . $authldap->fields[$criteria] . '=' . ($begin ? '' : '*') . ldap_escape($value, '', LDAP_ESCAPE_FILTER) . ($end ? '' : '*') . ')';
                 }
             }
         } else {

Source: GLPI commit 4fb3056. The fix wraps the untrusted $value with ldap_escape($value, '', LDAP_ESCAPE_FILTER) so filter metacharacters are rendered as literal data.

Detection Methods for CVE-2026-49469

Indicators of Compromise

GLPI application logs showing user import actions by hotliner or technician accounts targeting unusually broad or unexpected attribute values.
LDAP server logs showing filters containing stray )(, nested | or & operators, or wildcards originating from the GLPI service account.
Spikes in LDAP search result size from the GLPI host, especially results that include objects outside the configured organizational unit scope.

Detection Strategies

Enable verbose LDAP query logging on the directory server and alert on filters that contain unbalanced parentheses or boolean operators submitted via the GLPI bind account.
Review GLPI audit logs for the ldap_import or user-synchronization actions correlated with non-admin profiles.
Compare returned directory entries against the configured default filter baseline to identify out-of-scope objects accessed through import.

Monitoring Recommendations

Monitor the GLPI web server for POST requests to the LDAP user import endpoints originating from non-administrative sessions.
Track changes to GLPI AuthLDAP configuration and alert when the default filter is modified or bypassed.
Forward GLPI and directory logs to a centralized analytics platform and build detections around LDAP filter anomalies.

How to Mitigate CVE-2026-49469

Immediate Actions Required

Upgrade GLPI to version 10.0.26 or 11.0.8, which apply ldap_escape() on user-supplied import criteria.
Audit which accounts hold the hotliner or technician profiles and remove unneeded assignments.
Rotate the LDAP bind credentials used by GLPI if logs indicate exploitation.

Patch Information

The maintainers published the fix in GLPI release 10.0.26 and GLPI release 11.0.8. The code change is tracked in commits 4fb3056 and d413b48. See GHSA-3cgm-rj32-hfwf for the vendor advisory.

Workarounds

Restrict the LDAP bind account used by GLPI with a narrow directory ACL so it cannot read entries outside the intended scope, even when a filter is bypassed.
Temporarily revoke the LDAP user import permission from hotliner and technician profiles until the patch is applied.
Place the GLPI administrative interface behind network access controls that limit it to trusted operator subnets.

bash

# Example: verify the installed GLPI version prior to and after patching
grep -R "define('GLPI_VERSION'" /var/www/glpi/inc/define.php
# Expected after upgrade: '10.0.26' or '11.0.8'