CVE-2026-52848

CVSS 9.2 (critical) · published 2026-11-04

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Weakness: CWE-288

Source: NVD CVE-2026-52848

References

• https://github.com/glpi-project/glpi/commit/5ec327bfa78d12075e7224cfca5383b226f5babd
• https://github.com/glpi-project/glpi/releases/tag/11.0.8
• https://github.com/glpi-project/glpi/security/advisories/GHSA-hgr8-qvp5-mhch

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.