Executive brief
Snipe-IT is a web-based IT asset management system used by organizations to track hardware, software, and user licenses across multiple company tenants. This vulnerability allows a user assigned to one company to bypass tenant boundaries and access, modify, or delete user records belonging to out-of-scope tenants, extract sensitive personal information and license assignments, and even steal assets by fraudulently transferring them to themselves.
Technical details
The vulnerability is a broken authorization/privilege escalation issue (CWE-863) stemming from inconsistent authorization checks across multiple API endpoints and web routes. While the instance-level authorization function (isCurrentUserHasAccess) correctly enforces tenant boundaries, several endpoints—including GET /api/v1/users, GET /api/v1/users/{id}/licenses, POST /users/bulkeditsave, and POST /users/merge—rely on class-level permissions or overly broad scoped queries that fail to filter out users with company_id = null. A company-scoped attacker with low privileges can exploit this via network access (no special user interaction required) to read PII and license data, modify user profiles, soft-delete accounts, and transfer assets. The vulnerability affects Snipe-IT versions prior to 8.6.3 and has been patched in commit fbe05a8.
Affected products
- Grokability Snipe-IT < 8.6.3
Timeline
- 2026-08-19: disclosed: Published to GitHub Advisory Database
- 2026-08-19: patched: Patched in version 8.6.3 via commit fbe05a8