GLPI user cloning privilege escalation lets authenticated users create Super-Admin accounts (CVE-2026-121559)

What happened

GLPI 10.0.0 to before 10.0.28 and 11.0.0 to before 11.0.10 contain a privilege escalation flaw in user cloning (CWE-269). An authenticated user with the Technician profile can clone a Super-Admin account under a new login and password. User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, so the new account retains the Super-Admin profile. The result is an attacker-controlled Super-Admin account.

The CVSS 4.0 vector scores this 8.6 high: it is reachable over the network with low attack complexity, no user interaction, and high privileges required. The impact to confidentiality, integrity and availability of the GLPI system is high; subsequent systems are not affected. SSVC records no observed exploitation and rates the technical impact as total. The CVE record does not report exploitation in the wild.

Who is affected

Affected deployments are GLPI 10.0.0 to before 10.0.28 and 11.0.0 to before 11.0.10. GLPI is an open-source IT asset management and service desk platform, often run internally or made reachable for support teams; if you grant the Technician profile to users, the affected code is present in those versions. The CVE record does not describe additional affected products or configurations.

What to do now

1. Upgrade to a fixed release: GLPI 10.0.28 for installations on 10.0.0 to before 10.0.28, or GLPI 11.0.10 for installations on 11.0.0 to before 11.0.10. The fix is available in those versions.
2. If upgrading immediately is not possible, audit accounts and restrict profile assignments, particularly who holds Technician and Super-Admin rights. The CVE record does not list a separate workaround.
3. Search GLPI user administration for recently created accounts with Super-Admin profile; remove or disable any that cannot be tied to authorised provisioning.

How to detect it

Review GLPI user administration for new accounts that hold Super-Admin rights, especially accounts created by Technician users or outside the normal joiners and leavers process. Because the flaw clones profile and group assignments, an exploited instance will show a new privileged account rather than changed permissions on an existing one.

Beyond the patch

Beyond patching, treat this as an account-permission issue: an attacker used an existing high-privileged account to mint a new Super-Admin identity. Managed Detection & Response is relevant because privilege escalation and unusual account creation leave EDR and SIEM trails that can be detected. If your GLPI platform is reachable by partners or customers, Implementation & Assessment Services can test the deployment and review role assignments before they are abused.