CVE-2026-42318 HIGH

CVE-2026-42318: GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint

Vendor Glpi-Project
Product glpi
Weakness CWE-862 · Missing authorization
Published June 3, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.

Key dates

02Disclosure timeline

June 3, 2026 CVE published
June 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-49857 WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability CVE-2026-6709 Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter CVE-2023-5132 Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure CVE-2026-42337 MaxKB: Broken Access Control in MaxKB OSS URL Fetch API CVE-2023-38477 WordPress QR code MeCard/vCard generator plugin <= 1.6.0 - Broken Access Control vulnerability