What is CVE-2020-26212?

CVE-2020-26212 is a high-severity vulnerability in Glpi-Project Glpi, classified under Missing Authorization. CVSS score: 7.7/10. Published 2020-11-25.

How severe is CVE-2020-26212?

High severity. CVSS v3 base score is 7.7 out of 10.

Auth bypass in Glpi-Project Glpi

CVE-2020-26212

GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. Steps to reproduce the behavior: 1. Create a new planning with 'eduardo.mozart' user (from 'IT' group that belongs to 'Super-admin') into it's personal planning at 'Assistance' > 'Planning'. 2. Copy the CalDAV url and use a CalDAV client (e.g. Thunderbird) to sync the planning with the provided URL. 3. Inform the username and password from any valid user (e.g. 'camila' from 'Proativa' group). 4. 'Camila' has read-only access to 'eduardo.mozart' personal planning. The same behavior happens to any group. E.g. 'Camila' has access to 'IT' group planning, even if she doesn't belong to this group and has a 'Self-service' profile permission). This issue is fixed in version 9.5.3. As a workaround, one can remove the `caldav.php` file to block access to CalDAV server.

Vulnerability class: Broken Access Control

Published 2020-11-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.012 (66.3th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

Glpi-Project Glpi — versions < 9.5.3

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx (Exploit, Patch, Third Party Advisory)
github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7 (Patch, Third Party Advisory)
github.com/glpi-project/glpi/releases/tag/9.5.3 (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2020-26212?: CVE-2020-26212 is a high-severity vulnerability in Glpi-Project Glpi, classified under Missing Authorization. CVSS score: 7.7/10. Published 2020-11-25.
How severe is CVE-2020-26212?: High severity. CVSS v3 base score is 7.7 out of 10.