GHSA-52fw-7fw2-fmv5
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-48493
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Description
### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. ### Patches Patched in https://github.com/grokability/snipe-it/pull/19024
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · snipe/snipe-it | introduced 0, fixed 8.6.0 |
Références
- https://github.com/grokability/snipe-it/security/advisories/GHSA-52fw-7fw2-fmv5 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-48493 ADVISORY
- https://github.com/grokability/snipe-it/pull/19024 WEB
- https://github.com/grokability/snipe-it PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |