CVE-2024-47760

What it actually does

A lower-privileged API user can manipulate account objects to assume the identity and rights of a higher-privileged account.

Why it matters to the business

Attackers who already have limited technician access can obtain full administrative control over the IT asset management system, exposing sensitive inventory, configuration, and user data across the organization.

How an attack unfolds

An attacker with valid technician API credentials crafts or modifies API requests that target account management endpoints, causing the application to grant the caller the permissions of a higher-privileged account without proper authorization checks.

How to fix it

Upgrade glpi-project/glpi to a build containing commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 (version 10.0.17 or later). Restrict API access to the minimum required roles until the upgrade is complete.

How to confirm the fix worked

Confirm the running GLPI instance reports a version or commit hash that includes 08ee4d266768dc1f76cb6c716d7fd118d39676d9; re-test API calls with a technician account to verify that privilege escalation is no longer possible.

Typical attack path

1. Obtain valid low-privileged technician API credentials
2. Identify and call the vulnerable account-management API endpoints
3. Submit a crafted request that elevates the caller's privileges
4. Use the newly obtained higher privileges to access or modify sensitive records

How to detect it

Review GLPI API and application logs for unusual calls to account or user endpoints that result in privilege changes; look for authentication events followed immediately by high-privilege actions from the same session.

What your security team should do

• Apply the fixed commit or upgrade to 10.0.17 immediately
• Review and tighten API access controls for all technician accounts
• Monitor API logs for unexpected privilege-related operations
• Schedule a post-upgrade verification scan of the GLPI instance