GitHub Advisoryadvisory · Packagist

GHSA-52fw-7fw2-fmv5 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

MEDIUM Published 2026-06-23 Modified 2026-07-20 Official page ↗
Aliases
CVE-2026-48493
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-863
Reviewed
2026-06-23

Affected packages

• Packagist snipe/snipe-it: < 8.6.0 → fixed in 8.6.0

Description

Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. Patches Patched in https://github.com/grokability/snipe-it/pull/19024

Related

Alias · CVE (1)

  • CVE-2026-48493 Snipe-IT is an IT asset/license management system. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References