Is there a patch available for CVE-2026-44832?

Yes, a patch is available for CVE-2026-44832. Update the affected software to the latest version immediately.

CVE-2026-44832

Q: What is the CVSS score of CVE-2026-44832?

CVE-2026-44832 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31962 HIGH

Improper Preservation of Permissions (CWE-281)

2026-05-08 https://github.com/grokability/snipe-it

GHSA-hq28-crg7-95pr

Privilege Escalation

8.7

CVSS 4.0 · Vendor: https://github.com/grokability/snipe-it

Severity by source

Vendor (https://github.com/grokability/snipe-it) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/grokability/snipe-it) · only source for this CVE.

CVSS VectorVendor: https://github.com/grokability/snipe-it

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 02, 2026 - 16:37 NVD

7.1 (HIGH) 8.7 (HIGH)

CVSS changed

May 26, 2026 - 20:22 NVD

7.1 (HIGH)

CVE Published

May 08, 2026 - 22:24 nvd

HIGH

DescriptionCVE.org

Impact

An authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users.