CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-108726

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.

Score
5.3 medium
Published
2026-10-11
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/glpiglpi11.0.1_1,1unaddressedm@kappa.st

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>glpi</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GLPI through 12.0.0 contains a missing authorization vulnerability in
	ajax/map.php that allows authenticated low-privileged users to search
	itemtypes they cannot view by omitting the canView() check. Attackers
	can submit crafted itemtype and search criteria for types like
	Contact, Supplier, Contract and Budget to obtain match counts, titles
	and coordinates within their entities.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-108726</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-108726</url>
    </references>
    <dates>
      <discovery>2026-10-11</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>