GHSA-52fw-7fw2-fmv5MediumCVSS 5.5

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Published
June 23, 2026
Last Modified
June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-48493 →

📋 Description

Impact

A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.

Patches

Patched in https://github.com/grokability/snipe-it/pull/19024

🎯 Affected products1

  • composer/snipe/snipe-it:< 8.6.0

🔗 References (3)