Executive brief
Snipe-IT is an open-source IT asset management system used by organizations to track hardware, software licenses, and accessories. A security flaw allowed users with basic profile-editing permissions to grant themselves additional unauthorized privileges, such as the ability to create assets or view sensitive reports. While they could not grant themselves full administrative control, this could lead to unauthorized data access and modification of inventory records.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Snipe-IT API. Users possessing the 'users.edit' and API access permissions can bypass intended restrictions by sending a PATCH request to the '/api/v1/users/{id}' endpoint targeting their own user ID. This allows the user to modify their own permission set to include high-privilege actions like 'assets.create', 'reports.view', or 'import', though the application still prevents them from granting 'admin' or 'superuser' status. The vulnerability is rooted in insufficient server-side validation of permission changes when a user updates their own profile via the API. The issue is resolved in version 8.6.0.
Affected products
- Grokability Snipe-IT < 8.6.0
Timeline
- 2026-05-13: other: Fix PR submitted
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD