CVE-2024-48912

What it actually does

An authenticated user can invoke an application endpoint that lacks proper authorization checks, allowing deletion of arbitrary user accounts by supplying target identifiers.

Why it matters to the business

Attackers with valid credentials can disrupt operations by removing administrator or key user accounts, causing loss of access, workflow interruptions, and potential need for manual recovery in asset management environments.

How an attack unfolds

An attacker obtains valid low-privilege credentials, identifies the vulnerable endpoint through documentation or testing, and crafts requests that specify any user ID for deletion without ownership verification.

How to fix it

Upgrade GLPI to version 10.0.17 or apply the patch from commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9; for affected Ubuntu packages update teeworlds to 0.6.4+dfsg-1 where applicable.

How to confirm the fix worked

Verify installed version is at least 10.0.17, review endpoint access controls in source, and test that non-admin users cannot delete other accounts via the endpoint.

Typical attack path

1. Obtain authenticated session via valid credentials
2. Locate the user deletion endpoint in the application
3. Craft and send HTTP request targeting arbitrary user account
4. Confirm deletion and repeat for additional targets

How to detect it

Review application logs for deletion requests originating from non-administrator sessions or targeting unexpected user IDs; examine audit trails for account removals without corresponding administrative action.

What your security team should do

• Prioritize upgrade to fixed version 10.0.17 given the authorization bypass
• Audit current user permissions and recent account deletion logs
• Implement additional monitoring for unusual deletion activity
• Review and restrict endpoint access to authorized roles only