# CVE-2026-50550: Snipe-IT 2FA reset privilege bypass in user management

Source: https://junglewise.ai/threats/cve-2026-50550-snipe-it-2fa-reset-privilege-bypass-in-user-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-50550 · Severity: medium · CVSS 5.8 · Published 2026-08-19

Snipe-IT, a popular open-source asset management system, contains a security flaw that allows certain users to bypass two-factor authentication (2FA) protections. Specifically, a user with permissions to edit other profiles can reset the 2FA settings of a Superadmin. This could allow an attacker to weaken the security of the most powerful accounts in the system, potentially leading to full administrative takeover if they also possess the user's password.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it), [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-50550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50550 being exploited in the wild.

**How severe is CVE-2026-50550?** Medium severity, with a CVSS score of 5.8, published 19 August 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) < 8.5.0, ECOSYSTEM:introduced=0,fixed=8.5.0.

**Is there a fix for CVE-2026-50550?** Yes. snipe/snipe-it (Packagist): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50550 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-50550?** Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.5.0 or later

  ```sh
  composer require snipe/snipe-it:^8.5.0
  ```


## Technical details

A missing authorization vulnerability (CWE-862) in Snipe-IT allows a user with the 'edit users' permission to reset the two-factor authentication (2FA) settings for Superadmin accounts. The root cause is an insufficient check on whether the actor has the authority to modify the security settings of a higher-privileged user. The attack requires low privileges and user interaction, and is restricted to the adjacent network according to the CVSS metrics. Successful exploitation allows an attacker to remove the 2FA requirement for a Superadmin, facilitating account takeover if credentials are known. This issue is resolved in version 8.5.0.

## Affected products

- Grokability Snipe-IT < 8.5.0

## Identifiers

- CVE-2026-50550
- GHSA-6x4j-8954-5hxm

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: patched: Fixed in version 8.5.0
- 2026-06-23: advisory

## References

- [https://api.github.com/users/whatisproblem](https://api.github.com/users/whatisproblem)
- [https://github.com/whatisproblem](https://github.com/whatisproblem)
- [https://api.github.com/users/whatisproblem/gists%7B/gist_id%7D](https://api.github.com/users/whatisproblem/gists%7B/gist_id%7D)
- [https://api.github.com/users/whatisproblem/repos](https://api.github.com/users/whatisproblem/repos)
- [https://avatars.githubusercontent.com/u/98449009?v=4](https://avatars.githubusercontent.com/u/98449009?v=4)
- [https://api.github.com/users/whatisproblem/events%7B/privacy%7D](https://api.github.com/users/whatisproblem/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)