CVE-2026-44281: GLPI vulnerable to unauthorized reading of a specific asset object

Synopsis

An authorization bypass vulnerability in GLPI (an open-source IT asset management platform) allows an authenticated user with only config READ permission to read a specific asset object they should not have access to. The vulnerability is reachable over the network and requires a high-privilege account, based on the CVSS vector. Successful exploitation allows an attacker to tamper with or disrupt asset data, as indicated by the high integrity and availability impact scores. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GLPI service over the network; local or physical access is not required.

• AuthenticationRequired

  A high-privilege account (specifically one holding config READ permission) is needed to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can exploit this independently.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or special environmental conditions.

Blast Radius

• An attacker reads a specific asset object that their account should not have access to, potentially exposing sensitive IT inventory details.
• An attacker modifies persisted asset data, corrupting IT inventory records or altering configuration objects.
• An attacker disrupts availability of asset data, causing service degradation or loss of access to affected IT management records.