CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-53628

GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.

Score
5.9 medium
Published
2026-09-25
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/glpiglpi11.0.1_1,1unaddressedm@kappa.st

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>glpi</name>
	<range><lt>10.0.26</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GLPI is a free asset and IT management software package. From 0.84
	until 10.0.26 and 11.0.8, an administrator holding the Update auth and
	sync or Update auth, sync and 2FA right can change the authentication
	method and disable two-factor authentication for user accounts outside
	the administrator's entity scope. The affected user-account
	administration flow did not consistently enforce the target user's
	entity-scoped update permission. This issue is fixed in versions
	11.0.8 and 10.0.26.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-53628</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-53628</url>
    </references>
    <dates>
      <discovery>2026-09-25</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>