CVE-2026-42318: GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint

Synopsis

An authorization bypass in GLPI (the open-source IT asset management platform) allows any authenticated user with access to the planning feature to delete arbitrary objects throughout the application. The vulnerability is reachable over the network and requires only a low-privilege account, meaning no admin credentials are needed. Successful exploitation lets an attacker permanently delete any item in GLPI, causing data loss and potential service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment fix versions are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GLPI planning endpoint over the network; the service must be exposed to the attacker's network.

• AuthenticationRequired

  Any low-privilege GLPI account with access to the planning feature is sufficient; no admin or elevated credentials are needed.

• Victim interactionNot required

  The attacker can trigger the deletion directly without any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to succeed.

Blast Radius

• Attacker permanently deletes any object in the GLPI database, including assets, tickets, user records, and configuration items.
• Bulk deletion of critical IT asset records causes loss of inventory, audit trails, and incident history.
• Removal of configuration or user objects disrupts ongoing IT operations and may render managed services unresponsive.