Executive brief
Snipe-IT, a popular open-source IT asset management system, contains a flaw that allows regular users with basic editing permissions to grant themselves administrative access. By sending a specially crafted request to the system's programming interface (API), an employee or authorized user could take full control of the asset database. This could lead to unauthorized modification of inventory records, exposure of sensitive hardware data, or complete disruption of asset tracking operations.
Technical details
A privilege escalation vulnerability exists in Snipe-IT's API controller due to improper authorization checks during user updates. While the application correctly strips the 'superuser' key from incoming permission arrays, it fails to filter out the 'admin' key or other permission flags. An attacker with 'users.edit' privileges can send a PATCH request to '/api/v1/users/{id}' containing 'permissions[admin]=1' to grant themselves administrative rights. This vulnerability is classified under CWE-863 (Incorrect Authorization) and CWE-281 (Improper Preservation of Permissions). The issue is resolved in version 8.4.1.
Affected products
- Grokability Snipe-IT < 8.4.1
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched: Released in v8.4.1
References
- https://api.github.com/users/lorenzofradeani
- https://github.com/lorenzofradeani
- https://api.github.com/users/lorenzofradeani/gists%7B/gist_id%7D
- https://api.github.com/users/lorenzofradeani/repos
- https://avatars.githubusercontent.com/u/188067212?v=4
- https://api.github.com/users/lorenzofradeani/events%7B/privacy%7D