grokability/snipe-it · Security
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
- GHSA ID
- GHSA-52fw-7fw2-fmv5
- CVE ID
- CVE-2026-48493
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
- CVSS v3
- 5.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Description
Impact
A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.
Patches
Patched in https://github.com/grokability/snipe-it/pull/19024
CWEs
- CWE-863 · Incorrect Authorization