GLPI user cloning copied profile and group assignments without permission checks. A Technician could clone a Super-Admin account and set the credentials for the copy.
The cloned account carries the Super-Admin profile and groups. The attacker can then sign in with the credentials they chose. The advisory rates the issue High at CVSS 8.6.
GLPI 9.5.0 through 10.0.27 is patched in 10.0.28. GLPI 11.0.0 through 11.0.9 is patched in 11.0.10. The GitHub advisory was published on November 2, 2026; the CVE was published on November 3, 2026 via VulnCheck.
Sequence
Attack path
01
Step 1
Sign in as a Technician.
02
Step 2
Clone a Super-Admin account and choose the credentials for the copy.
03
Step 3
Profile and group assignments are copied without permission checks.
04
Step 4
Sign in to the cloned account with the chosen credentials at Super-Admin privilege.
#poc
Proof of concept
On affected releases, a Technician clone of a Super-Admin account kept the profile and groups and used the chosen credentials. The same cloning on 10.0.28 and 11.0.10 does not.
We will update this post at a later time to include additional proof of concept details. Operators should treat user cloning on affected releases as in scope and upgrade.
#exploit
Exploitation
The primitive is a cloned Super-Admin account with attacker-chosen credentials, reached from a Technician account.
The cloned account carries the copied profile and group assignments, so the privilege reached is Super-Admin.
We will update this post at a later time to include additional exploitation details.
#details
Technical details
Root cause: user cloning copied profile and group assignments without permission checks.
Affected configuration: GLPI 9.5.0 through 10.0.27 and 11.0.0 through 11.0.9. The starting account is a Technician; the cloned account is a Super-Admin.
The fix in 10.0.28 and 11.0.10 adds the missing permission checks to user cloning.
Remediation
Fixed in GLPI 10.0.28 and 11.0.10.
Upgrade to GLPI 10.0.28 or 11.0.10 or later on your release line.
Until you can upgrade, limit user cloning and account administration to people you already trust as administrators, and review recently cloned accounts.
How Submersion found it
01
Step 1
We will update this post at a later time to include proof of concept and exploitation details.
Basin was pointed at GLPI. It received the application and a running environment. It did not receive a vulnerability description, an exploit, a patch diff, or a prior disclosure.