Disclaimer: The security issues below do not yet have publicly disclosed CVE identifiers, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available.
Important: GLPI security update
Type/Severity
NetEye Product Security has rated this update as having a CRITICAL security impact.
Topic
An update for the glpi packages is now available for NetEye 4.
Security Fix for NetEye 4.50:
11.0.12_neteye1.25.8-1
Security Fixes
External authentication bypass Severity: Critical
Ticket category reflected XSS Severity: High
Reflected XSS in users authorization list Severity: High
Privilege escalation by entity administrator Severity: High
Stored XSS on VLAN Severity: High
Reflected XSS in form header Severity: High
Stored XSS in dashboards Severity: High
Administrator account deactivation by unauthorized user Severity: Medium
The most severe of these is an external authentication bypass: an unauthenticated attacker can circumvent the external authentication mechanism and gain access to GLPI accounts without valid credentials. The privilege escalation flaw allows an entity administrator to exceed the permissions of their own entity and act with elevated rights in contexts they should not control. Five reflected and stored XSS flaws (ticket categories, the users authorization list, VLANs, form headers and dashboards) let an attacker inject scripts into another user’s session, which can lead to session hijacking, theft of credentials or user data, and actions performed with the victim’s privileges. The remaining flaw allows an unauthorized user to deactivate an administrator account, resulting in a denial of service for that administrator.
Together, these vulnerabilities can lead to unauthorized access, privilege escalation, session hijacking, exposure of credentials and user data, or denial of service.
Disclaimer: The CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not available at this time. This post will be updated as soon as additional information becomes publicly available. Read More
Asset Management: GLPI agent inventory submissions through satellites now work with the glpiinventory plugin On NetEye satellites, nginx proxies GLPI inventory submissions from agents to the GLPI instance running on the master. Until now, the proxy covered only one endpoint, Read More
NagVis: honor recognize_services and exclude_members for Icinga DB hostgroups When NagVis renders a hostgroup summary object, two map options control which member states may influence the icon: recognize_services: if disabled, only the host states matter for the group icon; exclude_members: Read More
Important: PHP security update Type/Severity NetEye Product Security has rated this update as having a CRITICAL security impact. Topic Updates for the php and glpi packages are now available for NetEye 4. Security Fix for All NetEye Releases php-7.4.33-8.module+el8.10.0+25117+30337cca php-xmlrpc-7.4.33-8.module+el8.10.0+25117+30337cca php-xml-7.4.33-8.module+el8.10.0+25117+30337cca php-soap-7.4.33-8.module+el8.10.0+25117+30337cca php-process-7.4.33-8.module+el8.10.0+25117+30337cca php-pgsql-7.4.33-8.module+el8.10.0+25117+30337cca php-pdo-7.4.33-8.module+el8.10.0+25117+30337cca php-opcache-7.4.33-8.module+el8.10.0+25117+30337cca php-mysqlnd-7.4.33-8.module+el8.10.0+25117+30337cca php-mbstring-7.4.33-8.module+el8.10.0+25117+30337cca php-ldap-7.4.33-8.module+el8.10.0+25117+30337cca php-json-7.4.33-8.module+el8.10.0+25117+30337cca php-intl-7.4.33-8.module+el8.10.0+25117+30337cca php-gmp-7.4.33-8.module+el8.10.0+25117+30337cca php-gd-7.4.33-8.module+el8.10.0+25117+30337cca php-fpm-7.4.33-8.module+el8.10.0+25117+30337cca php-common-7.4.33-8.module+el8.10.0+25117+30337cca php-cli-7.4.33-8.module+el8.10.0+25117+30337cca php-7.4.33-8.module+el8.10.0+25117+30337cca Security Fix for NetEye 4.50 glpi-11.0.11_neteye1.25.7-1 glpi-neteye-config-11.0.11_neteye1.25.7-1 glpi-configurator-11.0.11_neteye1.25.7-1 glpi-autosetup-11.0.11_neteye1.25.7-1 glpi-11.0.11_neteye1.25.7-1 Security Read More
Important: Grafana security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the grafana packages are now available for NetEye 4. Security Fix for NetEye 4.50 12.4.13_neteye3.31.5-1 CVEs CVE-2026-15577CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2026-33374CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-93294CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Read More
