What is the CVSS score of EUVD-2026-42991?

EUVD-2026-42991 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Snipe-IT are affected by EUVD-2026-42991?

Snipe-IT versions prior to 8.6.2 contain a broken authorization vulnerability allowing authenticated users without explicit delete permissions to soft-delete other user accounts through a bulk…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-42991?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42991. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-42991?

Within 24 hours: Audit all user role assignments in Snipe-IT to identify users holding users.view and users.edit permissions; review audit logs for suspicious bulk user operations via /users/bulksave endpoint. Within 7 days: Implement application-level access restrictions by disabling bulk delete operations for non-admin roles or restricting endpoint access to admin accounts only; enforce role-based access control review. Within 30 days: Upgrade Snipe-IT to version 8.6.2 or later once released; establish continuous monitoring for authorization bypass attempts targeting the bulksave endpoint.

Snipe-IT EUVD-2026-42991

| CVE-2026-55460 HIGH

Incorrect Authorization (CWE-863)

2026-07-10 GitHub_M

GHSA-vgx7-c78r-69w9

Authentication Bypass Snipe It Grokability

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable authenticated low-priv user (PR:L, AV:N, AC:L); impact is a reversible soft-delete of one non-admin user, so integrity and availability are Low, confidentiality None.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:25 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

AnalysisAI

Broken authorization in Snipe-IT before 8.6.2 lets an authenticated non-admin user who holds users.view and users.edit - but explicitly not users.delete - soft-delete other non-admin user accounts by POSTing delete_user=1 to /users/bulksave. The root cause is that BulkUsersController::destroy() checks only the 'update' authorization, so the delete permission gate is never enforced. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Snipe-IT is a PHP/Laravel-based open-source IT asset and license management application that uses a granular permission model (users.view, users.edit, users.delete, etc.) enforced via policy/authorization checks. The flaw is a CWE-863 Incorrect Authorization: the bulk user endpoint (/users/bulksave) routes both bulk edit and bulk delete operations through BulkUsersController::destroy(), which authorizes the actor against the 'update' ability rather than a 'delete' ability. Because the delete branch (triggered by delete_user=1) inherits only the update check, a principal granted edit-but-not-delete can invoke the destructive path. The deletion is a Laravel soft-delete (deleted_at timestamp), so the record is flagged rather than physically removed. Per the CPE cpe:2.3:a:grokability:snipe-it, all versions prior to the fixed 8.6.2 build are in scope.

RemediationAI

Vendor-released patch: upgrade to Snipe-IT 8.6.2, which corrects BulkUsersController::destroy() to require proper delete authorization (fix commit 374f426f0c6bb7a4f129f7b85051cc1da753a0f5, release https://github.com/grokability/snipe-it/releases/tag/v8.6.2, advisory https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9). If immediate upgrade is not possible, reduce exposure by revoking the users.edit permission from any role that should not delete users so that untrusted principals cannot reach the bulk endpoint (trade-off: those users lose legitimate bulk-edit capability), and audit/restore any improperly soft-deleted accounts via the admin deleted-users view. Optionally restrict network access to the /users/ management routes to trusted admin networks, accepting that remote admins would then need VPN access.