Exploit for CVE-2026-53625

## https://sploitus.com/exploit?id=25417D6C-FFA2-5EE0-AEDB-34821218CD45
CVE-2026-53625 - GLPI Privilege Escalation via authtype Manipulation PoC


  




📌 Overview


  This repository provides an ethical Proof-of-Concept (PoC) for
  CVE-2026-53625, a High severity privilege escalation
  vulnerability in GLPI affecting all versions from 0.70 through 11.0.7.


  A low-privilege user (Technician) can take full control of any account, including
  Super-Admin, by manipulating the authtype field through the REST API.
  The attack chains three weaknesses to achieve complete account takeover with
  persistent backdoor creation.


  Official advisory:
  GHSA-94rp-v9f2-5rj7




📝 Vulnerability Summary


  GLPI does not check privilege levels when a user updates another user's record via
  the REST API. The authtype field is not protected, and changing it to
  EXTERNAL causes GLPI to automatically blank the victim's password.
  Combined with a forgeable SSO header (Remote-User), this allows full
  account takeover.



  CVE ID: CVE-2026-53625
  Affected Software: GLPI
  Affected Versions: 0.70 – 11.0.7
  Fixed in: 10.0.26, 11.0.8
  Severity: High — CVSS 7.5 (v4)
  Authentication: Required (Technician profile is enough)
  Impact: Full account takeover, persistent backdoor, admin lockout (DoS)
  Attack vector: REST API + forgeable SSO header


How it works

  
    Authenticate as a Technician via the REST API
    (POST /apirest.php/initSession)
  
  
    Enumerate users and identify Super-Admin targets
    (GET /apirest.php/User)
  
  
    Change the victim's authtype to EXTERNAL (4) via
    PUT /apirest.php/User/{id} — GLPI blanks the password automatically
    (User.php:1277)
  
  
    Forge a Remote-User: {victim} HTTP header to obtain a session
    as the victim — no password needed
  
  
    Switch to the Super-Admin profile and create a persistent backdoor account
  


Without SSO configured: the attack still works as a DoS — the victim's
password is blanked and they are locked out. No SSO required for this impact.



📚 References & Credit


  Advisory: GHSA-94rp-v9f2-5rj7
  CVE: CVE-2026-53625
  Discoverer: 7h30th3r0n3 (credited in the advisory)




⚠️ Legal Notice


  This PoC is for educational and authorized testing only.
  Use only on systems you own or where you have explicit permission.
  The author and contributors are not responsible for misuse.




📦 Installation

Clone the repository:
git clone https://github.com/7h30th3r0n3/CVE-2026-53625-GLPI-PoC.git
cd CVE-2026-53625-GLPI-PoC


Dependencies: bash, curl, python3, openssl

🖥️ Usage (CLI)

The PoC supports two attack modes:

# Full takeover chain (default) — requires SSO with forgeable header:
./poc_authtype_takeover.sh --auto http://glpi.local tech P@ss

# DoS only — lock out admin, no SSO needed:
./poc_authtype_takeover.sh --lockdown --auto http://glpi.local tech P@ss

# Safe mode — prove chain on sacrificial user, zero impact on real accounts:
./poc_authtype_takeover.sh --safe --verbose http://glpi.local tech P@ss

# Full takeover + restore victim afterward:
./poc_authtype_takeover.sh --backdoor --restore --restore-pass 'NewPass!' --auto http://glpi.local tech P@ss


Run ./poc_authtype_takeover.sh --help for all options.



✍️ Author

Vulnerability discovered and PoC developed by 7h30th3r0n3.