CVE-2026-26263 is a high severity (CVSS 8.1) unauthenticated time based blind SQL injection in the search engine of GLPI, the open source IT asset and service management package. It affects 11.0.0 up to but not including 11.0.6. The fix is GLPI 11.0.6. Until you can upgrade, turn off anonymous FAQ access.
What's affected
The GLPI project advisory (GHSA-346p-qj3v-9rxj) lists affected versions as 11.0.0 and later, with the patched version being 11.0.6. The NVD record states the range as 11.0.0 to before 11.0.6.
That means the 10.x line is not listed in the advisory, and 11.0.6 is the first release it names as fixed. If you run a version between 11.0.0 and 11.0.5, you are in range.
The flaw sits in GLPI's search engine and, according to the advisory, can be reached without logging in. The advisory's workaround points at anonymous access to the FAQ, which tells you where the unauthenticated door is.
How to check if you're exposed
Find every GLPI instance you run, including test and staging copies that nobody has looked at in a while. GLPI shows its version in the footer of the web interface once you are signed in.
If you run GLPI in containers, list the images and tags in use:
docker ps --format '{{.Names}} {{.Image}}'
Then look at the tag. Pinning to latest makes this harder, so record the actual version from the interface.
Next, check whether anonymous access to the FAQ is switched on. In the GLPI setup, look for the option that lets users who are not logged in see the knowledge base or FAQ. The advisory names this as the thing to disable, but GLPI's menus differ by version, so confirm the exact setting in the GLPI documentation for your release.
Finally, check how the instance is reachable. An internal only service is a lower exposure than one answering on the open internet.
What to do now
- Upgrade every GLPI 11.0.x instance to 11.0.6 or later. Take a database backup first and test the upgrade on a copy if you have a staging instance.
- If you cannot upgrade today, apply the advisory workaround: disable anonymous access to the FAQ so that only authenticated users can reach the vulnerable search.
- Put GLPI behind a VPN or an IP allow list if it does not need to be public. Help desk tools rarely need to be open to everyone.
- Review web server and database logs for unusually slow search requests or repeated search calls from one address. A time based blind injection works by measuring delays, so it leaves a pattern of slow responses.
- Treat the workaround as a stopgap, not a fix. The advisory says it only limits exploitation to authenticated users.
Why it matters
SQL injection (CWE-89) means user input ends up inside a database query as instructions instead of data. In a blind, time based variant, the attacker does not see query output. Instead the injected input makes the database pause or not pause, and the response time answers yes or no questions one at a time. It is slower than other forms, but it works without any visible error message.
The CVSS vector for this record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, no login, no user action. The one factor that holds the score at 8.1 instead of higher is attack complexity, which the CVSS vector rates high. The impact side is rated high on confidentiality, integrity and availability.
Why treat a help desk tool seriously? GLPI usually holds an inventory of the company's hardware and software, user records, tickets and sometimes credentials pasted into tickets. A database level compromise exposes all of that. The record is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say that it is being exploited.
The broader lesson is about unauthenticated paths. A feature that an anonymous visitor can reach, such as a public FAQ search, is attack surface. Each one should be a deliberate choice. If your help desk does not need a public knowledge base, switching it off removes a whole class of exposure, not only this bug.
Security teams often get GLPI through an upstream package or a container image rather than a repository they watch. That makes it easy to miss. Add it to the inventory you track for dependency and application scanning, with an owner and a patch window.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the workaround fix CVE-2026-26263?
No. The advisory says disabling anonymous FAQ access means only an authenticated user can exploit it. Upgrading to 11.0.6 is the fix.
Are GLPI 10.x versions affected?
The advisory lists 11.0.0 and later as affected and names 11.0.6 as the patched release. It does not list 10.x. Check your own version against the advisory.
Sources
Last reviewed: 19 October 2026.
