GitHub Advisoryadvisory · Packagist

GHSA-hf68-g98v-wp9g Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

MEDIUM Published 2026-06-23 Modified 2026-06-23 Official page ↗
Aliases
CVE-2026-55483
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-862
Reviewed
2026-06-23

Affected packages

• Packagist snipe/snipe-it: < 8.6.0 → fixed in 8.6.0

Description

Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new user with full admin privileges. The `users.create permission` may commonly be delegated to HR staff, department leads, or similar roles. Patches Patched in aea3877718

Related

Alias · CVE (1)

  • CVE-2026-55483 Snipe-IT is an IT asset/license management system. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References