EUVD-2026-35140Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular users.edit permission to lock every admin out of the instance by editing the activated flag (which determines whether or not a user can login) and the ldap_import flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.
AnalysisAI
Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding only the granular users.edit permission to disable administrator and superuser accounts through the bulk-edit endpoint, effectively locking all admins out of the instance. By toggling the activated and ldap_import flags on admin targets, a low-privileged actor denies admins both interactive login and password-reset recovery. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold an authenticated Snipe-IT session with the granular `users.edit` permission (PR:L) and network reachability to the application's `users/bulkeditsave` bulk-edit endpoint; no user interaction, no MFA bypass, and no admin role are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) accurately reflects the shape of the bug: network-reachable, low-complexity, requires a low-privileged account (PR:L - specifically the `users.edit` granular permission), no user interaction, and the dominant impact is availability (A:H, total admin lockout) with limited integrity (I:L, two flag fields) and no confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or attacker who has compromised a low-trust helpdesk account that carries the `users.edit` granular permission opens the bulk user-edit page, selects every admin and superuser, and submits the form with `activated=0` and `ldap_import=1`. The mass-assignment path applies both fields without consulting `canEditAuthFields`, so all administrators are simultaneously deactivated and flagged as LDAP-imported, denying both interactive login and the self-service password reset; the attacker now operates in an instance with no functional admin oversight until DBA-level recovery is performed. |
| Remediation | Vendor-released patch: upgrade Snipe-IT to 8.6.0 or later, which rewrites the bulk-user update to apply the `activated` and `ldap_import` fields per-user behind the `canEditAuthFields` and `editableOnDemo` policy checks and additionally hardens the user-merge endpoint; see the advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr and the patch at https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all users holding users.edit granular permission and restrict access to only trusted administrative staff; enable detailed logging on the bulk-edit endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today