CVE-2026-53625 - GLPI Privilege Escalation via authtype Manipulation PoC

📌 Overview

This repository provides an ethical Proof-of-Concept (PoC) for CVE-2026-53625, a High severity privilege escalation vulnerability in GLPI affecting all versions from 0.70 through 11.0.7.

A low-privilege user (Technician) can take full control of any account, including Super-Admin, by manipulating the authtype field through the REST API. The attack chains three weaknesses to achieve complete account takeover with persistent backdoor creation.

Official advisory: GHSA-94rp-v9f2-5rj7

📝 Vulnerability Summary

GLPI does not check privilege levels when a user updates another user's record via the REST API. The authtype field is not protected, and changing it to EXTERNAL causes GLPI to automatically blank the victim's password. Combined with a forgeable SSO header (Remote-User), this allows full account takeover.

• CVE ID: CVE-2026-53625
• Affected Software: GLPI
• Affected Versions: 0.70 – 11.0.7
• Fixed in: 10.0.26, 11.0.8
• Severity: High — CVSS 7.5 (v4)
• Authentication: Required (Technician profile is enough)
• Impact: Full account takeover, persistent backdoor, admin lockout (DoS)
• Attack vector: REST API + forgeable SSO header

How it works

1. Authenticate as a Technician via the REST API (POST /apirest.php/initSession)
2. Enumerate users and identify Super-Admin targets (GET /apirest.php/User)
3. Change the victim's authtype to EXTERNAL (4) via PUT /apirest.php/User/{id} — GLPI blanks the password automatically (User.php:1277)
4. Forge a Remote-User: {victim} HTTP header to obtain a session as the victim — no password needed
5. Switch to the Super-Admin profile and create a persistent backdoor account

Without SSO configured: the attack still works as a DoS — the victim's password is blanked and they are locked out. No SSO required for this impact.

📚 References & Credit

• Advisory: GHSA-94rp-v9f2-5rj7
• CVE: CVE-2026-53625
• Discoverer: 7h30th3r0n3 (credited in the advisory)

⚠️ Legal Notice

This PoC is for educational and authorized testing only. Use only on systems you own or where you have explicit permission. The author and contributors are not responsible for misuse.

📦 Installation

Clone the repository:

git clone https://github.com/7h30th3r0n3/CVE-2026-53625-GLPI-PoC.git
cd CVE-2026-53625-GLPI-PoC

Dependencies: bash, curl, python3, openssl

🖥️ Usage (CLI)

The PoC supports two attack modes:

# Full takeover chain (default) — requires SSO with forgeable header:
./poc_authtype_takeover.sh --auto http://glpi.local tech P@ss

# DoS only — lock out admin, no SSO needed:
./poc_authtype_takeover.sh --lockdown --auto http://glpi.local tech P@ss

# Safe mode — prove chain on sacrificial user, zero impact on real accounts:
./poc_authtype_takeover.sh --safe --verbose http://glpi.local tech P@ss

# Full takeover + restore victim afterward:
./poc_authtype_takeover.sh --backdoor --restore --restore-pass 'NewPass!' --auto http://glpi.local tech P@ss

Run ./poc_authtype_takeover.sh --help for all options.

✍️ Author

Vulnerability discovered and PoC developed by 7h30th3r0n3.