Two new bugfix versions of GLPI are out: 12.0.2 and 11.0.13. They fix several recently discovered security issues, so we strongly recommend updating.
Security fixes
The following vulnerabilities are fixed in both versions:
- [SECURITY - High 11.0 & 12.0] Privilege escalation via the legacy API
- [SECURITY - High 11.0 & 12.0] OAuth server consent bypass
- [SECURITY - High 11.0 & 12.0] Account takeover via an embedded dashboard
- [SECURITY - High 11.0 & 12.0] Stored XSS in document downloads via API-written filenames
Bug fixes
These releases also include many bug fixes. See the changelogs for details:
Download
Both archives are available on GitHub:
Thank you to everyone who contributed to these versions, and to all those who contribute regularly to the GLPI project!

