EUVD-2026-62679
GHSA-hf68-g98v-wp9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint with low complexity; PR:L because `users.create` is a specific but commonly delegated role; S:C because the attacker escalates beyond their authorization boundary to full admin control of the system.
Primary rating from Vendor (https://github.com/grokability/snipe-it).
CVSS VectorVendor: https://github.com/grokability/snipe-it
Lifecycle Timeline
3DescriptionCVE.org
Impact
The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.
The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.
Patches
Patched in aea3877718
AnalysisAI
Privilege escalation in Snipe-IT's user creation endpoint allows any authenticated holder of the users.create permission to provision new accounts with full admin privileges. The store() method in both the web UI and API UsersController correctly strips the superuser flag from user-creation payloads submitted by non-superusers, but applies no equivalent check to the admin permission, creating a direct path from delegated HR or department-lead roles to full administrative control over the Snipe-IT instance. A vendor-released patch is available in version 8.6.0; no public exploit has been identified at time of analysis.
Technical ContextAI
Snipe-IT is an open-source IT asset management platform built on Laravel/PHP (PURL: pkg:composer/snipe/snipe-it). The flaw resides in app/Http/Controllers/Users/UsersController.php within the store() method, which handles both web-form and REST API user creation. The root cause is CWE-862 (Missing Authorization): a conditional gate strips the superuser flag from the submitted payload when the creator is not a superuser, but no parallel gate exists for the admin permission. The fix in commit aea3877718 replaces the permissive check auth()->user()->can('canEditAuthFields', $user) with the stricter auth()->user()->isSuperUser(), ensuring only superusers can assign administrative roles or groups at account creation time. The commit diff also added test coverage confirming non-admins cannot assign privileged groups during user creation via either the UI or API paths.
RemediationAI
Upgrade Snipe-IT to version 8.6.0 or later; this is the vendor-confirmed fix version containing commit aea3877718 (https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb). The full security advisory is at https://github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g. If an immediate upgrade is not feasible, revoke the users.create permission from all non-superuser accounts as a compensating control; this eliminates the attack surface entirely but also prevents HR staff and department leads from creating accounts until the patch is applied - weigh the operational disruption accordingly. Following remediation or as a parallel action, audit all user accounts created by non-superusers since deployment to identify any accounts that were granted admin privileges through this flaw.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today