Snipe-IT EUVD-2026-42991

Exploitation requires an authenticated Snipe-IT session for a user/role that has been assigned the users.view and users.edit permissions but not users.delete - this specific permission combination is the prerequisite, and it reflects a common least-privilege help-desk/user-manager role. The attacker must POST delete_user=1 with a target ID to the /users/bulksave endpoint. Exploitation is limited to soft-deleting other non-admin users (admin accounts are not affected), the action is reversible by an administrator, and it is only reachable by principals already inside the application with edit-level user-management rights, so fully external unauthenticated attackers cannot trigger it.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) correctly captures a network-reachable, low-complexity attack requiring low privileges and no user interaction, with no confidentiality impact. The I:H rating appears somewhat aggressive: the operation is a reversible soft-delete of a single non-admin user, which a full administrator can restore, so real-world integrity/availability damage is bounded and does not extend to admin accounts or data destruction. There is no EPSS score, KEV listing, or POC in the supplied intelligence, so exploitation probability signals are absent - treat this as a privilege-boundary/permission-escalation issue rather than a mass-exploitation threat. Overall this is a moderate, real but limited-scope authorization bug: prioritize it where least-privilege user-management roles are actively used, but it is not an emergency network RCE.

An insider or a compromised low-privilege help-desk account that has been granted users.view and users.edit (but not users.delete) sends a crafted authenticated POST to /users/bulksave containing delete_user=1 and a target user ID. Because the endpoint only checks update rights, the target non-admin account is soft-deleted, disrupting that user's access without the attacker ever holding delete permission. No public POC is currently identified, but the request is trivial to reproduce given the documented parameter.