VulnerabilityDeferred

CVE-2026-42318

GLPI is a free asset and IT management software package.

HIGH 7.0EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.

CVSS 4.0: 7.0 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: security-advisories@github.com

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-w7mr-3vwm-2j22
https://vokecyber.com/research/cve-2026-42318-glpi-arbitrary-deletion

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.