GLPI 11.0.10 and 10.0.28 fix multiple high-severity security advisories

What happened

GLPI's project published eight security advisories covering high and medium severity flaws. GHSA-47mc-679g-2jrv is a reflected cross-site scripting issue in the dashboard search result widget: an attacker can craft a URL containing a script, and when a logged-in GLPI user opens that URL, the script runs in their browser. GHSA-j5vx-jrmw-2498 allows anonymous attackers to enumerate GLPI user names through the planning feature.

Several authenticated flaws allow users to exceed their rights. GHSA-3w48-r8r5-mf8c lets any authenticated user craft a URL to run unauthorised massive actions, including activating, deactivating or uninstalling plugins already present in the filesystem. GHSA-pjj6-ww22-86qh is a SQL injection through the form actors dropdown, available to any authenticated user with access to a form containing an actor dropdown. GHSA-c46f-4v9j-5gpc lets a technician clone a user and create an account with more privileges than their own. GHSA-mhhg-77qx-qf26 lets a technician disable or take control of two-factor authentication for a user with higher privileges. GHSA-5pgp-cfq7-4j9h lets a technician delete the account of a user with more rights. GHSA-5fw5-vgrw-ggp5 lets technicians read event content outside their entity scope.

None of the advisories reports active exploitation or public disclosure.

Who is affected

All eight advisories affect GLPI 11.0.0 through 11.0.9. For GLPI 10.0.x and earlier branches, the advisory ranges are:

• releases before 10.0.28 for the massive actions authorization bypass, the user deletion rights check, and the planning issues;
• 9.5.0 to before 10.0.28 for the user cloning privilege escalation;
• 9.1.0 to before 10.0.28 for missing authorization checks in planning;
• 9.2.0 to before 10.0.28 for user name enumeration via planning.

The reflected XSS, 2FA modification and SQL injection advisories affect only GLPI 11.0.0 to before 11.0.10. Fixed versions are GLPI 10.0.28 and GLPI 11.0.10.

What to do now

1. Upgrade any GLPI 11.0.0–11.0.9 installation to GLPI 11.0.10. This resolves all eight advisories.
2. Upgrade affected GLPI 10.0.x or older installations to GLPI 10.0.28. The fixes for the 9.x and 10.0.x ranges listed above are delivered in GLPI 10.0.28.
3. GLPI's advisories do not list workarounds, so treat the update as the primary control. Until it is complete, restrict access to the GLPI web interface to trusted network segments and review administrative changes.

How to detect it

GLPI has not published indicators of compromise for these advisories. While preparing the update, review for unauthorised plugin activations, deactivations or uninstallations; newly created users whose rights exceed those of the creating technician; changes to two-factor authentication on privileged accounts; and deletion of accounts with higher rights. For the SQL injection flaw, review application and database logs for unusual errors around forms that include actor dropdowns. Repeated requests to planning endpoints from unexpected sources may indicate the user name enumeration issue.

Beyond the patch

Beyond the patch, this bundle shows how much of GLPI's risk sits in application-level access controls and how much depends on tracking the project's release cadence. A penetration test and hardening review can reproduce the authorization and injection flaws described above, which is where our Implementation & Assessment Services fits. Supply Chain Defense & Third-Party Risk helps track GLPI's fix releases against the versions you actually run, so the next update window is visible rather than discovered after publication.