CVE-2026-55483: Snipe-IT privilege escalation in UsersController user creation

Executive brief

Snipe-IT, a popular open-source IT asset management system, contains a flaw that allows users with basic account creation permissions to grant themselves or others full administrative access. This could allow staff members in roles like HR or department leads to bypass security restrictions and gain total control over the asset management platform. An attacker with this level of access could modify sensitive inventory data, delete records, or compromise the integrity of the organization's asset tracking.

Technical details

A privilege escalation vulnerability exists in the `store()` method of both the web and API `UsersController` in Snipe-IT. While the application correctly strips 'superuser' permissions when a non-superuser creates a new account, it fails to perform a similar check for 'admin' permissions. Consequently, any authenticated user possessing the `users.create` permission can create a new user account and assign it full administrative privileges. This is classified as a missing authorization check (CWE-862). The vulnerability is addressed in version 8.6.0.

Affected products

• Grokability Snipe-IT < 8.6.0

Timeline

• 2026-06-12: disclosed
• 2026-06-23: advisory: GitHub Advisory published
• 2026-06-23: patched

References

• https://api.github.com/users/0xrdi
• https://github.com/0xrdi
• https://api.github.com/users/0xrdi/gists%7B/gist_id%7D
• https://api.github.com/users/0xrdi/repos
• https://avatars.githubusercontent.com/u/114161501?v=4
• https://api.github.com/users/0xrdi/events%7B/privacy%7D