GLPIの二要素認証を回避される脆弱性、11.0.8で修正
Summary
GLPI 11.0.0以上11.0.8未満に、細工したURLでログイン時のワンタイムパスワード確認を飛ばせる脆弱性が見つかりました。11系を使う組織は11.0.8へ更新し、外部公開の有無も確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
GLPI 11.0.0以上11.0.8未満に、細工したURLでログイン時のワンタイムパスワード確認を飛ばせる脆弱性が見つかりました。11系を使う組織は11.0.8へ更新し、外部公開の有無も確認してください。
Fix status by distribution
Fixed packages published by each distribution for this CVE Fixed versions differ by release; check each link.
- Ubuntu UBUNTU-CVE-2026-52848 glpi
Original description The description as published by the source.
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.
Source: CVE.org (CVE Program・cvelistV5) NVD