CVE-2026-49469

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.

• CWE-90

• https://github.com/glpi-project/glpi/commit/4fb3056bcd292b515acce96887f1376ce6d5aba8
• https://github.com/glpi-project/glpi/commit/d413b48ea97b2f73ba30c90ae0d029aac860f71a
• https://github.com/glpi-project/glpi/releases/tag/10.0.26
• https://github.com/glpi-project/glpi/releases/tag/11.0.8
• https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49463NL Portal Backend Libraries provide backend components for D…6.5
• CVE-2026-49464NL Portal Backend Libraries provide backend components for D…8.1
• CVE-2026-49465n8n is an open source workflow automation platform. Prior to…7.7
• CVE-2026-49466Draft List is a WordPress plugin to manage and promote unpub…6.5
• CVE-2026-49467Pingvin Share X is a secure and easy self-hosted file sharin…8.8
• CVE-2026-49468LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.8
• CVE-2026-4947Addressed a potential insecure direct object reference (IDOR…7.1
• CVE-2026-49470GLPI is a free asset and IT management software package. Fro…7.7
• CVE-2026-49471Serena is a powerful MCP toolkit for coding that provides se…8.3
• CVE-2026-49472FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-49473@cedar-policy/authorization-for-expressjs is an open-source …8.8
• CVE-2026-49475FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5