Snipe-IT CVE-2026-48492
MEDIUM
GHSA-f3c5-6cw8-fg57
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires low-privileged authenticated user, no interaction; confidentiality impact high, no integrity or availability loss.
Primary rating from Vendor (https://github.com/grokability/snipe-it).
CVSS VectorVendor: https://github.com/grokability/snipe-it
Lifecycle Timeline
3DescriptionCVE.org
Impact
The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled.
What an attacker can do with a valid login and zero permissions:
- Enumerate all active user accounts by paginating through the endpoint
- Harvest usernames for credential stuffing or password spray attacks
- Collect employee numbers and full names for social engineering
- Perform indirect email enumeration via the search parameter
- Map user IDs for use in further enumeration against other endpoints
This vulnerability is exploitable only by users who have a working login to the Snipe-IT system.
Patches
https://github.com/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f
AnalysisAI
Information disclosure in Snipe-IT versions before 8.5.1 allows any authenticated user, regardless of permissions, to enumerate all user accounts through the /api/v1/{object}/selectlist endpoint. The vulnerability exposes usernames, display names, employee numbers, and user IDs, facilitating credential stuffing, password spraying, and social engineering. The fix adds a missing authorization check and is available in release 8.5.1; no active exploitation or public exploit code has been identified at the time of analysis, and EPSS predicts a very low likelihood of widespread exploitation.
Technical ContextAI
Snipe-IT is an open-source IT asset management application built with the Laravel PHP framework. The vulnerable endpoint is part of the REST API, where the controller method that serves selectlist data did not enforce the 'view.selectlists' permission. This falls under CWE-862: Missing Authorization. The fix (commit 4f943d4a) adds $this->authorize('view.selectlists') to the affected controllers for assets, accessories, consumables, licenses, and users, restricting the endpoint to users with the appropriate permission. The vulnerable package is composer/snipe/snipe-it, as indicated by the CPE, and affects all installations prior to version 8.5.1.
RemediationAI
Upgrade Snipe-IT to version 8.5.1, which includes the authorization check. The patch is available at https://github.com/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f. If an immediate upgrade is not possible, restrict network access to the Snipe-IT web interface to trusted users (e.g., via firewall or VPN) and monitor API access logs for anomalous calls to the /api/v1/*/selectlist endpoints. However, these mitigations do not fully address the underlying missing authorization and may reduce functionality.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today