Vulnerability CVE-2026-23624: Information

Description

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

Severity: MEDIUM (6.5)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23624

Published: Feb. 4, 2026

Modified: Feb. 6, 2026

Error type identifier: CWE-384

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
glpi	sisyphus	11.0.5-alt1	11.0.5-alt1	ALT-PU-2026-2176-1	407092	Fixed
glpi	sisyphus_riscv64	11.0.5-alt1	11.0.5-alt1	ALT-PU-2026-2267-1	-	Fixed
glpi	sisyphus_loongarch64	11.0.5-alt1	11.0.5-alt1	ALT-PU-2026-2278-1	-	Fixed
glpi	p11	10.0.23-alt1	10.0.23-alt1	ALT-PU-2026-2168-3	407093	Fixed
glpi	p10	10.0.23-alt0.p10.1	10.0.23-alt0.p10.1	ALT-PU-2026-2293-3	407328	Fixed
glpi	p10_e2k	10.0.23-alt0.p10.1	10.0.23-alt0.p10.1	ALT-PU-2026-2730-1	-	Fixed
glpi	c10f2	10.0.23-alt0.p10.1	10.0.23-alt0.p10.1	ALT-PU-2026-2560-3	407877	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://github.com/glpi-project/glpi/releases/tag/10.0.23	Product Release Notes
https://github.com/glpi-project/glpi/releases/tag/11.0.5	Product Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477	Vendor Advisory

Affected configurations:
1. cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
  Start including
  0.71
  End excluding
  10.0.23
  cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
  Start including
  11.0.0
  End excluding
  11.0.5

Version: v26.2.2