Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-23624
4.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): PHYSICAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
GLPI is vulnerable to session stealing on externally authenticated user change
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .
References
-
https://github.com/glpi-project/glpi/security/advisories/GHSA-5j4j-vx46-r477 x_refsource_CONFIRM
-
https://github.com/glpi-project/glpi/releases/tag/10.0.23 x_refsource_MISC
-
https://github.com/glpi-project/glpi/releases/tag/11.0.5 x_refsource_MISC
Affected products
glpi
- ==>= 11.0.0-alpha, < 11.0.5
- ==>= 0.71, < 10.0.23
Matching in nixpkgs
pkgs.glpi-agent
GLPI unified Agent for UNIX, Linux, Windows and MacOSX
Package maintainers
-
@liberodark liberodark <liberodark@gmail.com>