Snipe-IT CVE-2026-48493
MEDIUM
GHSA-52fw-7fw2-fmv5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Requires users.edit+api perms (PR:H); network‑accessible; low complexity; high integrity impact.
Primary rating from Vendor (https://github.com/grokability/snipe-it).
CVSS VectorVendor: https://github.com/grokability/snipe-it
Lifecycle Timeline
3DescriptionCVE.org
Impact
A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser - for example assets.view, assets.create, reports.view, import, etc.
Patches
Patched in https://github.com/grokability/snipe-it/pull/19024
Articles & Coverage 1
AnalysisAI
Privilege escalation in Snipe-IT allows users with both 'users.edit' and 'api' permissions to send a PATCH request to their own user endpoint and grant themselves any non-admin, non-superuser permission (e.g., assets.view, reports.view, import). A publicly available exploit exists (GitHub gist), and a patch was released in version 8.6.0. The EPSS score is low (0.19%) and SSVC indicates no active exploitation, but the vulnerability represents a clear authorization bypass with high integrity impact.
Technical ContextAI
The vulnerability is an incorrect authorization check (CWE-863) in the PreserveUnauthorizedPrivilegedPermissionsAction class of Snipe-IT, a PHP/Laravel IT asset management application. The code originally did not validate whether a non‑superuser user was modifying their own permissions via the API endpoint /api/v1/users/{user_id}. The fix adds a $targetUser parameter and returns the original permissions if the authenticated user is not a superuser and is updating themselves. The affected product is identified by the CPE pkg:composer/snipe/snipe-it.
RemediationAI
Upgrade to Snipe-IT version 8.6.0 or later, which includes the fix from pull request #19024 (https://github.com/grokability/snipe-it/pull/19024). As a workaround, restrict the 'users.edit' and 'api' permissions to only highly trusted users; monitor API audit logs for PATCH requests to /api/v1/users/ endpoints from non‑superusers. Note that disabling the 'users.edit' permission may block legitimate user management workflows.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today