CVE-2026-128078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128078", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-12T21:24:51.130Z", "datePublished": "2026-11-13T17:43:49.161Z", "dateUpdated": "2026-11-13T17:43:49.161Z"}, "containers": {"cna": {"title": "GLPI: Unexpected access to followups/tasks/solutions generated from templates", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp"}, {"name": "https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d"}, {"name": "https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/10.0.27", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.27"}, {"name": "https://github.com/glpi-project/glpi/releases/tag/11.0.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/glpi-project/glpi/releases/tag/11.0.9"}], "affected": [{"vendor": "glpi-project", "product": "glpi", "versions": [{"version": ">= 9.5.0, < 10.0.27", "status": "affected"}, {"version": ">= 11.0.0, < 11.0.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-13T17:43:49.161Z"}, "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9."}], "source": {"advisory": "GHSA-h34m-gqcf-25cp", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "glpi", "vendor": "glpi-project", "versions": [{"status": "affected", "version": ">= 9.5.0, < 10.0.27"}, {"status": "affected", "version": ">= 11.0.0, < 11.0.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9."}], "id": "CVE-2026-128078", "lastModified": "2026-11-13T18:17:37.453", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-13T18:17:37.323", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d"}, {"source": "security-advisories@github.com", "url": "https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9"}, {"source": "security-advisories@github.com", "url": "https://github.com/glpi-project/glpi/releases/tag/10.0.27"}, {"source": "security-advisories@github.com", "url": "https://github.com/glpi-project/glpi/releases/tag/11.0.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.5.0,10.0.27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "glpi", "source": "cna", "vendor": "glpi-project"}, "product": "glpi", "vendor": "glpi-project"}], "created": "2026-11-13T20:30:21.625983+00:00", "updated": "2026-11-13T20:30:21.626027+00:00", "vendors": ["glpi-project", "glpi-project$PRODUCT$glpi"]}