NexTool Solutions

On November 12, 2026, the GLPI project released versions 12.0.2 and 11.0.13, flagged as "security release, upgrading is recommended". They fix five vulnerabilities, all rated high severity. Two allow taking over another user's account, one allows gaining permissions through the Legacy API and another affects the OAuth server of the new API. GLPI 10 did not get a new version. This is GLPI's fourth security round in less than three weeks. Below: what was fixed, in IT management terms, who needs to upgrade, the checklist for today and what to watch for when the technical details come out.

This post only uses what the project published up to November 12, 2026: the release notes and the changelog on GitHub. The detailed advisories for each vulnerability (the GHSAs) have not been published yet. Until then, no one outside the project knows whether they require a login, or which older versions are affected.

Summary for those with five minutes

The five vulnerabilities, in IT management terms

The official note only gives the name of each vulnerability. The middle column explains what the name means. The right column says who should look first. What an attacker needs (login, profile, network access) will only appear in the detailed advisories.

Two of the five directly affect the APIs: the Legacy one and the new one, with OAuth. If you connect GLPI to other systems, as we showed in the new GLPI 11 API in practice, this update is for you.

Who needs to upgrade

The version is shown in Setup > General, System tab.

What to do today

1. Check the version in Setup > General > System. Also note the version of each active plugin.
2. Back up three things: the database, the files folder (files) and the configuration folder. The configuration holds glpicrypt.key. Without it, the passwords stored in GLPI (mail collector, LDAP, integration secrets) can no longer be decrypted.
3. Upgrade a test copy first, if you have one. Patch updates are usually smooth, but the copy shows within minutes whether a plugin or integration complains.
4. Upgrade production. With the .tgz package: maintenance mode, code replacement and php bin/console database:update. With Docker and the official image: change the tag to glpi/glpi:12.0.2 or glpi/glpi:11.0.13 and bring the container up again. The full commands, with the backup precautions, are in our step by step from GLPI 11 to 12. That one is a major version change, but the backup, maintenance and check routine is the same.
5. Check after upgrading:
6. the new version in Setup > General > System;
7. login, including SSO or LDAP, if you use them;
8. opening, updating and solving a test ticket;
9. Setup > Plugins: all plugins that were active are still active;
10. the integrations that use the API (open a ticket through them) and the embedded dashboards, if any;
11. sending an email notification.

If users have to log in again after the upgrade, don't be surprised: one of the changes in 11.0.13 affects the session cookie name, which now includes the GLPI version.

If you can't upgrade today

Nothing here replaces the upgrade. These are measures to reduce exposure for a few days, while you schedule the window:

• If GLPI is exposed to the internet without need, restrict access (VPN or an allowlist of addresses).
• If no integration uses the Legacy API, turn off Enable Legacy REST API in Setup > General > API. Check first with whoever manages the integrations: a lot of older tooling still uses this API.
• Review the registered OAuth clients and delete the ones nobody uses.
• Review which dashboards are shared through an embed link and whether they still need to be.

What about GLPI 10?

No 10.0.x version was released on November 12. GLPI 10 received its last update on September 30, 2026, version 10.0.28, and no longer receives fixes.

It is not yet possible to know whether these five vulnerabilities exist in GLPI 10: the detailed advisories will list the affected versions. The OAuth server arrived with GLPI 11, so that vulnerability does not apply to 10. The other four affect features GLPI 10 also has: the old REST API, embedded dashboards, documents and password reset. If any of them exists there, there will be no fix. The risks of staying on 10 and the migration roadmap are in still on GLPI 10? The risks of staying and the roadmap to migrate.

Four rounds in less than three weeks

The pattern of the previous rounds helps with planning: the fix comes out first, and the public details follow weeks later. The vulnerabilities disclosed on Oct 26 had been fixed since Sep 16; those of Nov 2, since Sep 30. Those who upgraded in between were not exposed when the attack path was described in public. Those who did not upgrade were. At this pace, it pays to have a fixed patch update window every two weeks, always with a backup and a test copy.

What to watch for when the advisories come out

The advisories appear on the GLPI security advisories page on GitHub. When they come out, check:

• Whether the vulnerability requires a login. A vulnerability that works without a username and password moves up in priority, especially the password reset one, which sits on the login page.
• Which versions are affected, including whether GLPI 10 is on the list.
• The severity score (CVSS) and the CVE number, which your security team or your auditors will ask for.
• Whether there is an official mitigation for those who have not been able to upgrade yet.
• Whether there are reports of exploitation. As of Nov 12, 2026, there were none.

What else came in the releases

The full changelog is on GitHub (12.0.2 and 11.0.13). Three items stand out for administrators:

• 11.0.13: the "New" status icon is back in the ticket list, after disappearing in 11.0.12.
• 11.0.13: updates libraries used by GLPI that had their own security fixes.
• 12.0.2: performance improvements in the dashboard and in the ticket form.

NexTool news based on the official release notes for versions 12.0.2 and 11.0.13, published on November 12, 2026, and on the project's changelogs on GitHub. We did not run lab tests with these versions. The detailed advisories for each vulnerability had not been published as of the date of this text. GLPI is a registered trademark of Teclib'. NexTool is not affiliated with Teclib'.