GitHub Advisoryadvisory · Packagist

GHSA-hq28-crg7-95pr Snipe-IT has Privilege Escalation via API Permissions Assignment

HIGH Published 2026-05-08 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-44832
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-281, CWE-863
Reviewed
2026-05-08

Affected packages

• Packagist snipe/snipe-it: < 8.4.1 → fixed in 8.4.1

Description

Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users. Patches Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1 Workarounds None.

Related

Alias · CVE (1)

  • CVE-2026-44832 Snipe-IT is an IT asset/license management system. vulnerability

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-863 Incorrect Authorization weakness

References