CVE-2026-48493: Snipe-IT Privilege Escalation via Unauthorized Permission Grant

Technical summary

CVE-2026-48493 is an insecure direct object reference (IDOR) and authorization flaw in Snipe-IT prior to version 8.6.0. The PATCH endpoint /api/v1/users/{their_own_id} fails to enforce proper permission validation when a user modifies their own account. A user holding only users.edit permission can submit arbitrary permission grants in the API request body—such as assets.view, assets.create, reports.view, or import—and the backend applies those grants without verifying the user is authorized to assign such permissions to themselves. The vulnerability is bounded: superuser and admin role assignments are rejected, but all other permissions are accessible. The issue stems from CWE-863 (Incorrect Authorization), where the API lacks role-based access control checks on the permission assignment operation.

Business impact

This vulnerability enables unauthorized privilege escalation within Snipe-IT deployments. An employee or contractor with basic user edit rights can unilaterally grant themselves broad asset visibility, reporting access, or data import capabilities—potentially exposing IT inventory, licensing details, and procurement information to unauthorized parties. In regulated environments, this creates compliance risk (audit trails may show unauthorized access grants). For organizations using Snipe-IT as a source of truth for asset inventory and cost management, unauthorized asset creation or modification could corrupt critical IT records. The attack requires no external interaction, no network traversal beyond the Snipe-IT application, and no user involvement—a single API call from an authenticated session is sufficient.

Affected systems

Snipe-IT versions prior to 8.6.0 are vulnerable. The flaw affects any deployment where standard (non-admin) users are provisioned with users.edit permission. Organizations running 8.6.0 or later are not affected. There is no indication that the Snipe-IT SaaS offering or specific hosting models are exempt; patching should be applied to all instances regardless of deployment model.

Exploitability

Exploitability is straightforward for an insider with users.edit permission. No exploit code, special tools, or public PoCs are required—a standard HTTP PATCH request with JSON payload is sufficient. Network access requirements are low (CVSS AV:N indicates network reachability). The attack requires prior authentication and a defined user account, so external unauthenticated attackers cannot exploit this directly. However, the risk is elevated in environments where user accounts are provisioned liberally or where account credentials are shared or compromised. The CVSS score of 5.5 (Medium) reflects the need for authenticated access, but also acknowledges the high integrity impact (unauthorized permission grants) and information disclosure risk.

Remediation

Upgrade Snipe-IT to version 8.6.0 or later, which patches the authorization check on the /api/v1/users/{their_own_id} PATCH endpoint. Prior to patching, restrict the users.edit permission to trusted administrative staff only, and audit access logs to identify any unauthorized permission grant attempts. Additionally, review Snipe-IT's audit logs for the date range between the vulnerability's discovery and your patch deployment to confirm no unauthorized privilege escalation has occurred.

Patch guidance

Snipe-IT 8.6.0 and later contain the fix. Consult the Snipe-IT release notes and vendor advisory to confirm patch applicability to your version. If you are running a version older than 8.6.0, prioritize an upgrade as soon as testing permits. Verify the patch by confirming the version number after deployment (admin panel or API version endpoint). Test the fix in a non-production environment first to ensure compatibility with any custom configurations or integrations.

Detection guidance

Monitor Snipe-IT API logs for PATCH requests to /api/v1/users/* endpoints, particularly from accounts with users.edit permission. Look for requests that include permission-related fields in the JSON payload (e.g., assets.view, assets.create, reports.view, import). Correlate these logs with the user's known role and permissions—any mismatch (e.g., a basic user granting themselves admin-like permissions) is suspicious. In SIEM or log aggregation systems, flag API error responses (403 Forbidden, 401 Unauthorized) to the same endpoint if your patch has been applied, which would indicate patch validation is working. Review Snipe-IT's built-in audit trail for changes to user permissions and cross-reference with HR or access request records to confirm legitimacy.

Why prioritize this

Although the CVSS score is Medium (5.5), this vulnerability warrants expedited patching because it enables a low-privileged insider to autonomously expand their own access to sensitive IT asset data without audit trail manipulation or admin involvement. The ease of exploitation (one API call) and the high integrity impact (unauthorized permission grants) make this a strong candidate for privilege escalation attack chains. In multi-tenant or shared hosting scenarios, this could facilitate lateral movement or data exfiltration. Organizations should prioritize this patch alongside critical and high-severity vulnerabilities in their IT service management stack.

Risk score, explained

The CVSS v3.1 score of 5.5 is driven by: Attack Vector (Network) and Attack Complexity (Low), indicating a low bar to reach and exploit the flaw; Privileges Required (High), acknowledging that authentication is needed; User Interaction (None), confirming no social engineering or user action is required; and a Scope (Unchanged) with Confidentiality (Low), Integrity (High), and Availability (None) impact. The integrity impact is elevated because an attacker can modify their own permission set, corrupting the authorization model. The confidentiality impact is lower because the attacker gains visibility only to assets and reports their elevated permissions allow—not a full database dump. The lack of availability impact is correct; privilege escalation does not disrupt service. The Medium severity reflects the requirement for prior authentication, which limits blast radius compared to unauthenticated exploits, but the ease of exploitation and privilege escalation nature justify closer scrutiny than the score alone might suggest.

Frequently asked questions