UpHeron
All vulnerabilities

Servers and applications

CVE-2024-48912

Insecure account deletion by authenticated user

Severity
High 7.2
Published
11 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.17
Also known as
GHSA-vjmw-j32j-ph4f
Sources
NVD, Project advisories (GitHub)

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • From 10.0.0 before 10.0.17
GLPIServers and applications · github:glpi-project/glpi
  • From 10.0.0 before 10.0.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-48912
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-48912
  • GitHub Advisory Database https://github.com/advisories/GHSA-vjmw-j32j-ph4f
  • github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-vjmw-j32j-ph4f