CVE-2026-22247 is a medium severity server side request forgery (CVSS 4.1) in the webhook feature of GLPI, the IT asset management package. It affects 11.0.0 up to before 11.0.5 and needs an administrator account. The fix is GLPI 11.0.5, so upgrade.
What's affected
GLPI from 11.0.0 to before 11.0.5. The fixed version is 11.0.5.
The advisory says an administrator can make the server send requests through the Webhook feature. The scope in the CVSS vector is changed, which means a request from GLPI can touch systems beyond GLPI itself.
How to check if you're exposed
Open GLPI and check the version shown in the interface, or look at the version in your container image tag or package.
If you see 11.0.0 through 11.0.4, you are affected. Versions in the 10.x line are outside the range the record describes. Then list who holds administrator rights, because the flaw needs one.
What to do now
- Upgrade GLPI to 11.0.5 or later, following the project release notes.
- Review the list of administrator accounts and remove any that are not needed.
- Check existing webhook definitions for destinations you do not recognise.
- Where possible, block outbound traffic from the GLPI host to internal admin interfaces and cloud metadata addresses.
- Scan your other dependencies and add GLPI to your inventory so future advisories find it.
Why it matters
SSRF, tracked as CWE-918, lets a user make a server send requests on their behalf. The server often has network access that the user does not, such as internal services or cloud metadata endpoints. That is why the scope is marked as changed even though confidentiality impact is rated low.
The score is only 4.1 because an administrator account is required. The record does not say it is exploited in the wild, and it is not on the CISA KEV list. Treat it as a routine upgrade, with extra care on hosts that sit inside sensitive networks.
Quick check
Do I need an administrator account to exploit this?
Yes. The record and advisory both say a GLPI administrator can perform the request through the webhook feature.
Is there a workaround?
The advisory only lists the patch, which is GLPI 11.0.5. Limiting administrator accounts and outbound traffic reduces exposure while you upgrade.
Sources
Last reviewed: 19 October 2026.
