CVE-2026-53625 – GLPI

GLPI versions 11.0.8 and 10.0.26 fix five privilege escalation flaws in the IT asset management platform, one Critical and four High. CVE-2026-48482 has a CVSS score of 9.4, Critical severity. A form administrator can import a crafted form that writes a malicious script to an executable server location and then runs it remotely. CVE-2026-47679 has a CVSS score of 8.5, High severity. Any logged-in user can abuse the profile-picture update to delete a file of their choice from the server.

CVE-2026-49470 has a CVSS score of 7.7, High severity. It allows unlimited one-time password attempts, so an attacker who already holds a user's password can brute-force the second factor and take over the account. CVE-2026-53625 has a CVSS score of 7.5, High severity. A technician can change another user's authentication method through the API, which can lead to takeover of a super-administrator account. CVE-2026-53626 has a CVSS score of 7.1, High severity. It lets users read documents linked to items they are not allowed to access. Upgrade to GLPI 11.0.8, or to 10.0.26 on the 10.x branch, to close all five flaws.