What is the CVSS score of EUVD-2026-35140?

EUVD-2026-35140 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Snipe-IT are affected by EUVD-2026-35140?

Snipe-IT instances running versions prior to 8.6.0 face a critical administrative lockout risk: authenticated users with limited `users.edit` permission can permanently disable all administrator and…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-35140?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35140. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-35140?

Within 24 hours: audit all users holding `users.edit` granular permission and restrict access to only trusted administrative staff; enable detailed logging on the bulk-edit endpoint. Within 7 days: verify Snipe-IT 8.6.0 availability from vendor and prepare upgrade procedure in test environment; implement compensating controls listed below if production upgrade cannot be expedited. Within 30 days: deploy Snipe-IT 8.6.0 or later to all production instances; perform full administrative account verification and reconfigure role-based access controls to minimize `users.edit` permission holders.

Snipe-IT EUVD-2026-35140

| CVE-2026-48507 HIGH

Incorrect Authorization (CWE-863)

2026-06-08 GitHub_M

GHSA-6f75-x745-xcpr

Authentication Bypass Snipe It

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 08, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 08, 2026 - 17:15 vuln.today

Analysis Generated

Jun 08, 2026 - 17:15 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular users.edit permission to lock every admin out of the instance by editing the activated flag (which determines whether or not a user can login) and the ldap_import flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

AnalysisAI

Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding only the granular users.edit permission to disable administrator and superuser accounts through the bulk-edit endpoint, effectively locking all admins out of the instance. By toggling the activated and ldap_import flags on admin targets, a low-privileged actor denies admins both interactive login and password-reset recovery. No public exploit identified at time of analysis, but the upstream fix and detailed advisory disclose the exact attack surface.

Technical ContextAI

Snipe-IT is a Laravel/PHP-based open-source IT asset and license management application by Grokability. The flaw lives in app/Http/Controllers/Users/BulkUsersController.php, where the bulk user-update flow applied the activated and ldap_import fields via a mass-assignment helper (conditionallyAddItem) without gating them through the canEditAuthFields policy check that the per-user paths enforce. CWE-863 (Incorrect Authorization) captures the root cause: the policy that prevents non-admins from editing admins (and admins from editing superusers) was applied conditionally to groups but skipped for the two authentication-controlling fields, so authorization was incorrectly evaluated for those columns. The patched commit (403f9c8) removes the mass-assignment shortcut and routes both fields through a per-user loop guarded by canEditAuthFields and editableOnDemo, and additionally tightens the user-merge endpoint (raising it from update to delete authorization and re-checking canEditAuthFields per target).

RemediationAI

Vendor-released patch: upgrade Snipe-IT to 8.6.0 or later, which rewrites the bulk-user update to apply the activated and ldap_import fields per-user behind the canEditAuthFields and editableOnDemo policy checks and additionally hardens the user-merge endpoint; see the advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr and the patch at https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a. If immediate upgrade is not possible, the most effective compensating control is to audit and revoke the granular users.edit permission from any non-admin role, restricting it to trusted admin/superuser accounts only - the trade-off is that delegated helpdesk/HR workflows that legitimately edit user records will break until the upgrade lands. As an additional defensive measure, block POST access to the users/bulkeditsave route (e.g., via a reverse-proxy or WAF rule) for non-admin sessions, accepting that this disables bulk user edits entirely; and pre-stage an out-of-band superuser recovery account (kept off ldap_import) so that a lockout can be unwound without database surgery.