What is the CVSS score of CVE-2026-49976?

CVE-2026-49976 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.

Is there a patch available for CVE-2026-49976?

Yes, a patch is available for CVE-2026-49976. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-49976

MEDIUM

Missing Authorization (CWE-862)

2026-06-23 https://github.com/grokability/snipe-it

GHSA-p68w-rgmg-3c2v

PHP Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

AV:N and AC:L are clear; PR:L not PR:H because import is a specific delegated non-admin permission, not full administrative control; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 23:51 vuln.today

Analysis Generated

Jun 23, 2026 - 23:51 vuln.today

DescriptionGitHub Advisory

Impact

The CSV user import in update mode bypasses user-edit authorization. A user with only the import permission can overwrite any non-admin user's email by uploading a CSV, then trigger a password reset to take over the account.

UserImporter.php checks the canEditAuthFields gate and tries to strip auth fields from the model:

php

// app/Importer/UserImporter.php:107-114
if (Auth::check() && (! Gate::allows('canEditAuthFields', $user))) {
    unset($user->username);
    unset($user->email);
    unset($user->password);
    unset($user->activated);
}
$user->update($this->sanitizeItemForUpdating($user));

The unset()s operate on the model, but sanitizeItemForUpdating() rebuilds its array from $this->item (the raw CSV row), not from the model:

php

// app/Importer/ItemImporter.php:135-149
protected function sanitizeItemForStoring($model, $updating = false)
{
    $item = collect($this->item);                  // CSV data, not model attributes
    $item = $item->only($model->getFillable());
    if ($updating) {
        $item = $item->reject(fn($v) => empty($v));
    }
    return $item->toArray();
}

The attacker's CSV values pass through untouched.

For non-admin attacker vs. non-admin, non-superuser target, the gate returns true at AuthServiceProvider.php:137, so the unset() block never executes. The entire import path checks only $this->authorize('import') (ImportController.php:196); no users.edit check anywhere. The normal API route PATCH /api/v1/users/{id} correctly returns 403 for the same user.

Attacker must have import privileges to exploit this, and that permission must be granted specifically and intentionally by a superadmin.

Patches

Patched in v8.6.0

AnalysisAI

Account takeover in Snipe-IT (versions prior to 8.6.0) is achievable by any user holding the import permission via a logic flaw in the CSV user-import update path. The UserImporter.php code correctly unsets auth fields from the Eloquent model object, but sanitizeItemForUpdating() rebuilds its update payload from the raw CSV row ($this->item) - not from the model - rendering the unset calls entirely ineffective. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain import permission from superadmin

Delivery

Craft CSV row with target user identifier and attacker-controlled email

Exploit

Upload CSV via import update mode endpoint

Execution

Auth bypass allows email overwrite in database

Persist

Trigger password reset to attacker-controlled email

Impact

Authenticate as target user, completing account takeover

Access

Obtain import permission from superadmin

Delivery

Craft CSV row with target user identifier and attacker-controlled email

Exploit

Upload CSV via import update mode endpoint

Execution

Auth bypass allows email overwrite in database

Persist

Trigger password reset to attacker-controlled email

Impact

Authenticate as target user, completing account takeover

Vulnerability AssessmentAI

Exploitation	The attacker must hold the `import` permission, which is a non-default capability that must be explicitly and intentionally granted by a superadmin - regular authenticated users do not have this permission. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects network exploitation with high confidentiality and integrity impact but requires high-level privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker holding the `import` permission constructs a CSV file with a row matching an existing non-admin user's identifier (e.g., username or employee number) and substitutes an attacker-controlled email address. They upload the CSV through Snipe-IT's import update interface; the authorization bypass causes the target user's email to be silently overwritten. …
Remediation	Upgrade Snipe-IT to version 8.6.0 or later, which resolves the authorization bypass in the CSV import pipeline. … Detailed patch versions, workarounds, and compensating controls in full report.