Escalade GLPI Plugin Vulnerable to Improper Access Control
Priority LOW 35CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead to data exposure and workflow disruptions. This issue has been patched in version 2.9.11.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed escalade (pluginsGLPI): 2.9.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pluginsGLPI | escalade | before 2.9.11 | 2.9.11 | Patch available | CNA |
- escalade VendorpluginsGLPI Affected before 2.9.11 Fixed in 2.9.11 Patch available CNA
Remediation
- Fix · CNA escalade (pluginsGLPI) Fixed in 2.9.11
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27153
References
More pluginsGLPI vulnerabilities
- TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
- TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
- TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
- TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
- TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
- TI-2025-33324 pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences