CVE-2024-47758

What it actually does

Authenticated users can invoke API endpoints to assume control of any account possessing equal or lesser privileges, bypassing intended authorization checks.

Why it matters to the business

Attackers with valid low-level credentials can access and manipulate IT asset records, tickets, and configurations belonging to other users at the same or lower tier, increasing insider risk and potential data exposure in asset-management environments.

How an attack unfolds

An attacker authenticates with a valid account, crafts API requests that target user takeover functionality, and issues calls that switch the session context to any equal or lower-privileged target account without additional authentication.

How to fix it

Upgrade glpi-project/glpi to commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 (version 10.0.17) or later. For Red Hat Enterprise Linux 9 appstream packages, update thunderbird, thunderbird-debuginfo, and thunderbird-debugsource to 0:91.10.0-1.el9_0 or newer.

How to confirm the fix worked

Confirm the installed GLPI version is 10.0.17 or newer, review API access-control tests for user-impersonation paths, and verify that privilege-escalation attempts are rejected in staging environments.

Typical attack path

1. Obtain valid credentials for an authenticated GLPI account
2. Interact with the GLPI REST API using those credentials
3. Submit crafted requests to user-impersonation or takeover endpoints
4. Operate under the identity of any equal or lower-privileged user

How to detect it

Review web-server and application logs for API calls that modify or switch user context, especially repeated calls from a single authenticated session targeting multiple accounts; correlate with authentication events and look for privilege changes without corresponding login activity.

What your security team should do

• Immediately upgrade all GLPI instances to the patched release
• Audit API access logs for unusual user-context switches
• Enforce least-privilege principles and review existing user role assignments
• Monitor EPSS trend and watch for public exploit code given the high CVSS score