EUVD-2026-62677
GHSA-6x4j-8954-5hxm
Severity by source
AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Web application reachable over network (AV:N); low privileges reflect required edit-user role (PR:L); no victim interaction needed to reset 2FA (UI:N); impact is purely integrity - disabling MFA - with no confidentiality or availability effect.
Primary rating from Vendor (https://github.com/grokability/snipe-it).
CVSS VectorVendor: https://github.com/grokability/snipe-it
Lifecycle Timeline
2DescriptionCVE.org
Impact
A user who can edit other users could reset a superadmin's 2FA.
Patches
Patched in 8.5.0
AnalysisAI
Privilege escalation in Snipe-IT allows a low-privileged authenticated user with 'edit users' permission to reset a superadmin's two-factor authentication (2FA), stripping the highest-privilege account of its MFA protection. This CWE-862 (Missing Authorization) flaw affects all Snipe-IT composer releases prior to 8.5.0. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; however, the high integrity impact and direct erosion of the superadmin's secondary authentication factor make this a meaningful risk wherever the superadmin account is the critical security boundary.
Technical ContextAI
Snipe-IT is an open-source PHP/Laravel-based IT asset management application distributed as the Composer package snipe/snipe-it (CPE: pkg:composer/snipe_snipe-it). The root cause is CWE-862 (Missing Authorization): the user-editing workflow does not enforce a privilege boundary check before allowing a lower-privileged user to manipulate 2FA settings on a superadmin account. Laravel's authorization layer (policies/gates) was not applied - or was applied insufficiently - to the 2FA reset action within user management, meaning any user whose role grants 'edit users' permission inherits the ability to target accounts of higher privilege. The tag 'Authentication Bypass' reflects the downstream consequence: defeating 2FA undermines the authentication assurance of the superadmin account even without directly compromising credentials.
RemediationAI
Upgrade Snipe-IT to version 8.5.0 or later; this is the vendor-released patch that resolves the missing authorization check (vendor advisory: https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm). If immediate patching is not possible, restrict the 'edit users' permission exclusively to fully trusted administrators - this reduces the population of accounts capable of triggering the flaw, but does not eliminate it for those who retain the permission. Additionally, audit current role assignments for any accounts that hold user-edit rights but should not; removing unnecessary grants is an effective compensating control. There are no other published workarounds; the underlying code path must be patched for complete remediation.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today