Snipe-IT EUVD-2026-43001

Exploitation requires two concurrent conditions: (1) the attacker must possess a valid Snipe-IT API key, and (2) the associated account must have CSV import capabilities granted within Snipe-IT's role and permissions model. Both conditions must be met simultaneously; unauthenticated access or accounts lacking import capability cannot exploit this endpoint. Exploitation is strictly limited to integrity of created_by metadata on import records - no confidentiality breach or service disruption is possible. Default Snipe-IT installations that grant import roles to non-administrator users are vulnerable without further configuration change. The UI:R metric in the provided CVSS vector implies some form of user interaction is required beyond the attacker's own submission; this is not described in the advisory and defenders should seek vendor clarification before relying on it as a mitigating factor.

The vendor-assigned CVSS score of 5.7 (Medium) accurately reflects the constrained impact surface. Network access is required (AV:N), but exploitation demands both a valid API key and a role with CSV import capabilities (PR:L), substantially limiting the exploitable population. The provided CVSS vector includes UI:R, suggesting a second-party interaction is required, though the advisory description does not explicitly identify what that interaction is - this metric warrants vendor clarification and defenders should not assume it provides meaningful protection. Integrity impact is rated High (I:H) because ownership falsification directly undermines audit trails and asset accountability. No EPSS data was provided; absence from CISA KEV and no identified public POC place this as a low-urgency issue for most organizations. Real-world priority escalates for environments using Snipe-IT import audit logs for compliance, insider-threat detection, or change management accountability, where falsified created_by records could conceal unauthorized imports or shift blame to innocent users.

An attacker holding a valid Snipe-IT API key with the CSV import role crafts a CSV import file in which the created_by field references a different user account - such as an administrator or an auditor - and submits it to the Importer API endpoint. The system processes the import and records the falsified user as the owner of the imported assets, potentially concealing the attacker's activity or attributing unauthorized imports to another account. No public exploit code is known, and the attack requires pre-existing authenticated access with import permissions.