CVE-2026-47678

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

• CWE-89

• https://github.com/glpi-project/glpi/commit/7cffc8f59f55ad2d955123004296bf83f25ee9f2
• https://github.com/glpi-project/glpi/commit/c261f2d93e35b6e5d872bfd4e73d7673be69cd68
• https://github.com/glpi-project/glpi/releases/tag/10.0.26
• https://github.com/glpi-project/glpi/releases/tag/11.0.8
• https://github.com/glpi-project/glpi/security/advisories/GHSA-v774-5g3p-vxg2

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47671Nhost is an open source Firebase alternative with GraphQL. I…5.4
• CVE-2026-47672epa4all-client is the Java Client for epa4all / ePA 3.0 in t…6.5
• CVE-2026-47673Hono is a Web application framework that provides support fo…6.5
• CVE-2026-47674Hono is a Web application framework that provides support fo…5.3
• CVE-2026-47675Hono is a Web application framework that provides support fo…5.3
• CVE-2026-47676Hono is a Web application framework that provides support fo…5.3
• CVE-2026-47679GLPI is a free asset and IT management software package. Fro…8.5
• CVE-2026-47680The source-controller is a Kubernetes operator, specialised …5.3
• CVE-2026-47682CVAT is an open source interactive video and image annotatio…7.1
• CVE-2026-47683vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.…8.7
• CVE-2026-47684Sync-in Server is a secure, open-source platform for file st…7.7
• CVE-2026-47685FOG is a free open-source cloning/imaging/rescue suite/inven…8.7