CVE-2026-108726 Details

A missing authorization vulnerability has been identified in GLPI versions through 12.0.0, specifically in the ajax/map.php file. This vulnerability allows authenticated low-privileged users to search item types they do not have permission to view. The issue arises because the canView() authorization check is omitted. Attackers can exploit this by crafting item type and search criteria for types such as Contact, Supplier, Contract, and Budget, to retrieve match counts, titles, and coordinates of related records within their accessible entities.

The vulnerability can be addressed by adding the missing canView() authorization check to the ajax/map.php file, before the search is executed. This should be done by validating that the item type is a valid CommonDBTM subclass and that the user has the right to view it. Additionally, a regression test should be implemented to ensure that profiles without the necessary read rights receive an Access Denied response when accessing the map endpoint.