CVE-2026-48492: Snipe-IT Authorization Bypass in User Enumeration API

Technical summary

The GET /api/v1/{object}/selectlist API endpoint in Snipe-IT fails to enforce authorization controls, resulting in CWE-862 (Missing Authorization). The endpoint is accessible to any authenticated user, allowing them to enumerate and retrieve paginated user account metadata regardless of their assigned permissions within the system. The scope remains unchanged (authorization bypass does not escalate privileges system-wide), but confidentiality is fully compromised for user directory data. CVSS 3.1 scores this as 6.5 (Medium): network-exploitable, low attack complexity, requiring valid login credentials (PR:L), with no integrity or availability impact.

Business impact

Organizations face exposure of internal user directories that may include employee names, identifiers, and organizational mappings. This intelligence is commonly used in targeted attacks, credential stuffing campaigns, and social engineering. For firms with strict separation of duties, the leak violates audit expectations around least-privilege access. Incident response and forensics are complicated by the fact that any employee can silently enumerate all accounts without logs flagging unusual behavior. The actual business risk depends on downstream use of the exposed data and your organization's threat profile.

Affected systems

Snipe-IT versions prior to 8.6.1 are affected. Version 8.6.1 and later contain the authorization fix. The vulnerability affects all instances regardless of deployment model (on-premises or cloud) and does not depend on optional features, though scope of exposure varies: if FMCS (Financial Management and Compliance Suite or similar multi-company isolation) is disabled, all users see all accounts; if FMCS is enabled, enumeration is scoped to users within the same company.

Exploitability

Exploitability is straightforward. An attacker needs only a valid Snipe-IT user account—any employee credential or guest account—and a web browser or HTTP client. No special tools, no zero-click scenario, no race conditions. The API returns paginated user lists, making bulk extraction trivial. The CVSS PR:L (requires low privileges) reflects this realistic attack surface. However, this is not an unauthenticated exploit; it does require prior access to the Snipe-IT system itself. The lack of abnormal API behavior or logging makes detection difficult in real time.

Remediation

Upgrade Snipe-IT to version 8.6.1 or later. The patch adds authorization checks to the selectlist API endpoint, ensuring users can only retrieve account lists relevant to their assigned permissions. No configuration changes or workarounds are documented. Organizations should verify that the patch was cleanly applied and test that non-admin users no longer receive full user enumeration results from the API.

Patch guidance

Apply Snipe-IT version 8.6.1 or newer as soon as practical. If a delay is necessary, restrict access to the Snipe-IT system to trusted users and monitor for unusual API consumption patterns (many rapid calls to /api/v1/{object}/selectlist). Test the patch in a non-production environment first to ensure compatibility with custom integrations, if any. Review release notes for that version to confirm no breaking changes affect your deployment.

Detection guidance

Look for repeated or bulk requests to GET /api/v1/{object}/selectlist by individual user sessions, especially if pagination parameters indicate full enumeration of the user table. Baseline normal API usage by role; admin and IT staff may legitimately call this endpoint, but widespread calls from business users are suspicious. Check web server and application logs for a spike in 200 responses to that endpoint from single source IPs or sessions. If detailed API logging is available, correlate request timestamps with user login times to identify out-of-business-hours access. Note that successful exploitation leaves minimal trace if logs are not verbose.

Why prioritize this

This vulnerability should be patched within your standard change window, typically 30–90 days depending on your risk tolerance and user base. It is not an unauthenticated RCE or integrity breach, so it does not warrant emergency patching. However, directory enumeration feeds into social engineering and targeted attacks, particularly in high-value environments. Organizations in regulated industries (finance, healthcare, defense) should prioritize it higher due to audit implications. If Snipe-IT is internet-facing or accessible from untrusted networks, move it up in the queue.

Risk score, explained

CVSS 3.1 assigns 6.5 (Medium) because the vulnerability requires authentication (PR:L), has no integrity or availability impact, and is remotely exploitable. The high confidentiality impact (C:H) reflects total exposure of user account metadata to any authenticated user. The score does not account for the probability that an attacker can obtain valid credentials or the likelihood of the data being monetized; those are organizational risk factors. SEC.co consensus is that the 6.5 score fairly reflects technical severity but that business risk in your environment may be higher if Snipe-IT is core to your identity/asset discovery workflow or if your threat model includes insider threats.

Frequently asked questions