Executive brief
Snipe-IT is an IT asset and license management system used by organizations to track hardware and software. A security flaw allows any logged-in user, even those with no special permissions, to download a complete list of all employee accounts in the system. This could lead to the exposure of sensitive staff information like full names, employee numbers, and usernames, which can be used for phishing or further targeted attacks.
Technical details
A missing authorization check (CWE-862) exists in the 'selectlist' method within various API controllers (e.g., AccessoriesController, AssetsController) of Snipe-IT. The vulnerability is reachable via the GET /api/v1/{object}/selectlist endpoint. An attacker with valid low-privileged credentials can exploit this by using their web session cookie to bypass intended permission gates. This allows for the enumeration of usernames, display names, employee numbers, and user IDs. The issue is resolved in version 8.5.1 by adding explicit authorization checks to the affected API methods.
Affected products
- Grokability Snipe-IT < 8.5.1
Timeline
- 2026-05-21: patched: Fix committed to repository
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE published to NVD