CVE-2023-46727: GLPI inventory endpoint SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS percentile makes this an urgent patch target.

What it is

GLPI versions 10.0.0 through 10.0.10 expose an inventory endpoint that is vulnerable to SQL injection. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8, so unpatched instances are at serious risk.

Impact

An unauthenticated attacker can inject SQL through the inventory endpoint, potentially reading or modifying database contents and compromising the GLPI application and its data.

Attack surface

The vulnerability is reached over the network via the GLPI inventory endpoint, per the CVSS vector AV:N/PR:N/UI:N, meaning no authentication or user interaction is required.

Exploitation

The record shows no CISA KEV listing and no public exploit references, but EPSS is 0.67726 (99.28th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Upgrade GLPI to version 10.0.11 or later, which contains the patch.
• If immediate upgrade is not possible, disable native inventory as a workaround.
• Restrict network access to the GLPI inventory endpoint to trusted inventory sources only.
• Review database and application logs for anomalous queries against the inventory endpoint.

Detection

• Monitor GLPI inventory endpoint requests for SQL metacharacters or unusual query patterns.
• Alert on unexpected database errors or slow queries originating from the inventory endpoint.
• Audit GLPI database accounts for signs of unauthorized reads or writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.