Executive brief
Snipe-IT is an asset management system used to track and organize organizational inventory. An authenticated non-admin user with limited permissions (users.view and users.edit, but not users.delete) can bypass authorization checks to delete other user accounts through direct API calls. An attacker can soft-delete arbitrary non-admin users without proper authorization, disrupting account access and causing operational disruption.
Technical details
The vulnerability is an incorrect authorization check (CWE-863) in the bulk user save endpoint. The UI and confirmation route properly enforce the users.delete permission, but the destructive sink (`BulkUsersController::destroy()`) only checks for users.update permission. An authenticated attacker with users.view and users.edit permissions can POST directly to `/users/bulksave` with `delete_user=1` and a target user ID to trigger a soft-delete operation that bypasses the intended authorization model. The attack requires network access and valid authentication credentials, but no additional user interaction or CSRF token generation beyond what an authenticated session provides (CSRF token is included in the POST). The fix (commit 374f426f0c) aligns the authorization check in the destroy method with the delete permission requirement.
Affected products
- grokability snipe-it <= 8.6.1
Timeline
- 2026-06-24: disclosed: Published by GitHub Security Advisory
- 2026-07-10: advisory: Published by NVD
- 2026-08-28: patched: Fixed in version 8.6.2 (commit 374f426f0c)
References
- https://api.github.com/users/mamdouhmahfouz
- https://github.com/mamdouhmahfouz
- https://api.github.com/users/mamdouhmahfouz/gists%7B/gist_id%7D
- https://api.github.com/users/mamdouhmahfouz/repos
- https://avatars.githubusercontent.com/u/127619974?v=4
- https://api.github.com/users/mamdouhmahfouz/events%7B/privacy%7D