What is the CVSS score of CVE-2026-49976?

CVE-2026-49976 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-49976?

Yes, a patch is available for CVE-2026-49976. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-49976

EUVD-2026-62675 MEDIUM

Missing Authorization (CWE-862)

2026-06-23 https://github.com/grokability/snipe-it

GHSA-p68w-rgmg-3c2v

PHP Authentication Bypass

6.5

CVSS 3.1 · Vendor: https://github.com/grokability/snipe-it

Severity by source

Vendor (https://github.com/grokability/snipe-it) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

AV:N and AC:L are clear; PR:L not PR:H because import is a specific delegated non-admin permission, not full administrative control; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/grokability/snipe-it).

CVSS VectorVendor: https://github.com/grokability/snipe-it

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 23:51 vuln.today

Analysis Generated

Jun 23, 2026 - 23:51 vuln.today

DescriptionCVE.org

Impact

The CSV user import in update mode bypasses user-edit authorization. A user with only the import permission can overwrite any non-admin user's email by uploading a CSV, then trigger a password reset to take over the account.

UserImporter.php checks the canEditAuthFields gate and tries to strip auth fields from the model:

php

// app/Importer/UserImporter.php:107-114
if (Auth::check() && (! Gate::allows('canEditAuthFields', $user))) {
    unset($user->username);
    unset($user->email);
    unset($user->password);
    unset($user->activated);
}
$user->update($this->sanitizeItemForUpdating($user));

The unset()s operate on the model, but sanitizeItemForUpdating() rebuilds its array from $this->item (the raw CSV row), not from the model:

php

// app/Importer/ItemImporter.php:135-149
protected function sanitizeItemForStoring($model, $updating = false)
{
    $item = collect($this->item);                  // CSV data, not model attributes
    $item = $item->only($model->getFillable());
    if ($updating) {
        $item = $item->reject(fn($v) => empty($v));
    }
    return $item->toArray();
}

The attacker's CSV values pass through untouched.

For non-admin attacker vs. non-admin, non-superuser target, the gate returns true at AuthServiceProvider.php:137, so the unset() block never executes. The entire import path checks only $this->authorize('import') (ImportController.php:196); no users.edit check anywhere. The normal API route PATCH /api/v1/users/{id} correctly returns 403 for the same user.

Attacker must have import privileges to exploit this, and that permission must be granted specifically and intentionally by a superadmin.

Patches

Patched in v8.6.0

AnalysisAI

Account takeover in Snipe-IT (versions prior to 8.6.0) is achievable by any user holding the import permission via a logic flaw in the CSV user-import update path. The UserImporter.php code correctly unsets auth fields from the Eloquent model object, but sanitizeItemForUpdating() rebuilds its update payload from the raw CSV row ($this->item) - not from the model - rendering the unset calls entirely ineffective. An authenticated user with only import rights can overwrite any non-admin, non-superuser account's email address and then trigger a password reset to complete a full account takeover. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the vendor-published advisory includes precise source code and a working reproduction path.

Technical ContextAI

Snipe-IT is a PHP/Laravel-based open-source IT asset management application (package: composer/snipe/snipe-it). The flaw (CWE-862: Missing Authorization) lies in a disconnect between two layers of the import pipeline. UserImporter.php calls unset() on Eloquent model properties ($user->email, $user->username, etc.) to strip auth fields before persistence, but sanitizeItemForUpdating() in ItemImporter.php reconstructs the update array by calling collect($this->item) - reading from the raw CSV-sourced item array, not from the modified model attributes. Because Laravel's Eloquent unset() on the model object does not mutate $this->item, the CSV-supplied values pass through to $user->update() untouched. A secondary issue is that ImportController.php:196 only enforces $this->authorize('import'), with no users.edit check anywhere in the import path - while the direct API route PATCH /api/v1/users/{id} correctly returns 403. The gate logic at AuthServiceProvider.php:137 also allows the canEditAuthFields check to return true for a non-admin attacking another non-admin non-superuser, meaning the unset block does not even execute in the primary attack scenario.

RemediationAI

Upgrade Snipe-IT to version 8.6.0 or later, which resolves the authorization bypass in the CSV import pipeline. The vendor-released patch is confirmed in the GHSA advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-p68w-rgmg-3c2v. As an immediate compensating control prior to patching, superadmins should audit and revoke the import permission from all users who do not have a strict operational need for it, since that permission is the sole gateway to exploitation; reducing the number of users with this role directly limits blast radius. There is no known non-disruptive network-layer workaround because the import endpoint must remain accessible to legitimate import users. Do not rely on restricting the users.edit permission as a mitigating control - the import path does not check it.