Executive brief
Snipe-IT is an asset management system that allows organizations to track equipment and inventory through CSV imports. A user with CSV import permissions and a valid API key can modify the `created_by` field of import records to falsely attribute items to other users, enabling accountability evasion and audit trail manipulation.
Technical details
This vulnerability is an incorrect authorization (CWE-863) flaw in Snipe-IT's Importer API endpoint. An authenticated user with CSV import capabilities can arbitrarily overwrite the `created_by` field of imported assets by sending a crafted request with a valid API key, bypassing proper field validation and authorization checks. The attack requires network access to the API endpoint and user interaction (crafting the import), but the attacker must already possess valid API credentials and import permissions. This allows attackers to falsely attribute asset creation to other users, compromising audit trails and accountability. The vulnerability was patched in version 8.6.1; all versions 8.6.0 and earlier are affected.
Affected products
- Grokability Snipe-IT <= 8.6.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: Version 8.6.1 released
- 2026-08-28: advisory