CVE-2026-55217: GLPI Authorization Bypass Vulnerability

CVE-2026-55217 Overview

GLPI is a free, open-source IT asset and service management platform used by organizations to track hardware, software, and knowledge base content. CVE-2026-55217 is a broken access control vulnerability [CWE-285] affecting GLPI versions from 0.85 up to 10.0.26 and 11.0.8. A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without holding the authorization required for the target content. The flaw was fixed in GLPI 10.0.26 and 11.0.8.

Critical Impact
Any authenticated GLPI user can tamper with knowledge base comments and translations across the platform, enabling content manipulation, misinformation, and destruction of internal documentation.

Affected Products

GLPI versions 0.85 through 10.0.25
GLPI 11.0.x versions prior to 11.0.8
Deployments exposing the knowledge base module to standard authenticated users

Discovery Timeline

2026-09-25 - CVE-2026-55217 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-55217

Vulnerability Analysis

The flaw resides in the GLPI knowledge base module, specifically in the HTTP endpoints that handle comment and translation operations. The server-side scripts front/knowbaseitem_comment.form.php and front/knowbaseitemtranslation.form.php processed create, update, purge, and revert actions without verifying the acting user's rights against the target KnowbaseItem_Comment or KnowbaseItemTranslation object.

As a result, a user holding only a basic authenticated session could submit crafted POST requests to add arbitrary comments, modify existing translations, or purge content belonging to other users. This impacts the integrity of knowledge base articles that often support IT operations, security runbooks, and end-user documentation.

Root Cause

The root cause is missing authorization enforcement [CWE-285]. In the vulnerable code path for comments, the handler called KnowbaseItem::canComment() on the parent article but never validated the acting user's permission on the comment object itself. For translations, the handler invoked $translation->add(), $translation->update(), and $translation->delete() without a prior check() call for the CREATE, UPDATE, or PURGE right.

Attack Vector

Exploitation requires network access to the GLPI web interface and a valid low-privileged account. The attacker sends authenticated POST requests directly to the vulnerable form handlers, supplying knowbaseitems_id and payload fields. No user interaction from an administrator is required, and no additional privileges are needed beyond basic authentication.

php

// Patch excerpt - front/knowbaseitemtranslation.form.php
$translation = new KnowbaseItemTranslation();
if (isset($_POST['add'])) {
+    $translation->check(-1, CREATE, $_POST);
     $translation->add($_POST);
     Html::back();
} elseif (isset($_POST['update'])) {
+    $translation->check($_POST['id'], UPDATE, $_POST);
     $translation->update($_POST);
     Html::back();
} elseif (isset($_POST["purge"])) {
+    $translation->check($_POST['id'], PURGE, $_POST);
     $translation->delete($_POST, true);
     Html::redirect(KnowbaseItem::getFormURLWithID($_POST['knowbaseitems_id']));
}
// Source: https://github.com/glpi-project/glpi/commit/1cbf69b99dfd0610f1c03a3f245f3b248e1bfde0

The patch replaces an incomplete parent-object check with explicit check() calls on each operation, enforcing the correct right (CREATE, UPDATE, PURGE) on the comment or translation object itself.

Detection Methods for CVE-2026-55217

Indicators of Compromise

Unexpected POST requests to /front/knowbaseitem_comment.form.php or /front/knowbaseitemtranslation.form.php from accounts that do not normally author knowledge base content
Knowledge base comments or translations modified, created, or deleted by low-privileged users in the GLPI audit log
Spikes in add, update, or purge actions against the glpi_knowbaseitems_comments or glpi_knowbaseitemtranslations tables

Detection Strategies

Review GLPI event logs (Event::log) for knowledge base write operations correlated with non-editor accounts
Enable web server access logging and alert on POST requests to the two vulnerable form endpoints from unusual source IPs or user agents
Compare current knowledge base content against backups or version history to identify unauthorized modifications

Monitoring Recommendations

Forward GLPI application logs and web server logs into a centralized analytics platform for correlation and historical search
Baseline normal knowledge base editing activity per user role, then alert on deviations such as mass purge or update actions
Monitor outbound links or embedded content added via comments and translations for signs of social engineering or phishing payloads

How to Mitigate CVE-2026-55217

Immediate Actions Required

Upgrade GLPI to version 10.0.26 or 11.0.8, which contain the authorization fixes
Audit all knowledge base comments and translations modified before the upgrade and roll back unauthorized changes
Review user and profile assignments to ensure only intended accounts have write access to the knowledge base

Patch Information

The maintainers released fixes in GLPI 10.0.26 and GLPI 11.0.8. Technical details are published in GitHub Security Advisory GHSA-xm3v-3g6q-g9q8, with the code changes in commits 1cbf69b and 9c29f25b. The patches add check() calls that enforce the proper CREATE, UPDATE, and PURGE rights on each comment and translation operation.

Workarounds

Restrict network access to the GLPI interface so that only trusted users can reach the application until the patch is deployed
Temporarily revoke knowledge base write rights from standard user profiles if upgrade is not immediately possible
Place a web application firewall rule in front of front/knowbaseitem_comment.form.php and front/knowbaseitemtranslation.form.php to limit which authenticated roles may POST to those endpoints

bash

# Example: verify installed GLPI version before and after upgrade
grep "GLPI_VERSION" /var/www/glpi/inc/define.php

# After upgrade, confirm you are on a fixed release
# Expected output: define('GLPI_VERSION', '10.0.26'); or '11.0.8'