CVE-2026-48507: Snipe-IT Privilege Escalation Allows Admin Lockout (CVSS 7.1)

Technical summary

CVE-2026-48507 is an authorization bypass vulnerability in Snipe-IT arising from insufficient permission validation when editing user account flags. The `users.edit` permission grants access to modify the `activated` flag (controls login capability) and the `ldap_import` flag (controls password reset eligibility). Because the application fails to restrict these sensitive modifications to administrative users, a non-admin can systematically disable all administrator accounts, rendering the instance inaccessible to legitimate admins. The vulnerability is classified under CWE-863 (Incorrect Authorization).

Business impact

This vulnerability poses a severe operational risk: a single user with minimal permissions can deny all administrators access to their asset management system. This constitutes a complete denial of service at the administrative level, preventing inventory tracking, license compliance monitoring, and user management. Recovery requires external intervention or system restoration from backup. Organizations relying on Snipe-IT for compliance and IT hygiene face potential compliance violations during lockout periods, along with downtime costs and remediation effort.

Affected systems

Snipe-IT versions prior to 8.6.0 are affected. Any deployment running an older version is at risk if users hold the `users.edit` granular permission. The severity depends on permission assignment practices—organizations that carefully limit this permission to trusted personnel face lower risk than those using permissive role configurations.

Exploitability

The vulnerability requires valid credentials and the `users.edit` permission, so external unauthenticated exploitation is not possible. However, the barrier to exploitation is low once a user holds that permission: no special tools or interaction are needed—an attacker simply edits user flags through the normal admin interface. This is a local, authenticated attack with straightforward execution paths.

Remediation

Upgrade Snipe-IT to version 8.6.0 or later, which contains the patch. Before upgrading, audit your user permission assignments to ensure the `users.edit` permission is granted only to trusted administrators. Consider implementing additional access controls or monitoring for changes to administrative user accounts in your pre-upgrade environment.

Patch guidance

Snipe-IT version 8.6.0 and later include the fix. Follow the vendor's standard upgrade procedure. Test the patch in a non-production environment first to ensure compatibility with your configuration and integrations. After upgrading, verify that administrative accounts are accessible and that user editing functionality works as expected.

Detection guidance

Review audit logs for suspicious user account modifications, particularly disabled `activated` flags on administrative accounts or changes to `ldap_import` settings made by non-administrative users. Monitor for access attempts by administrators to accounts that were recently disabled. If Snipe-IT logs are forwarded to a SIEM, create alerts for user deactivations performed by accounts without administrative roles.

Why prioritize this

This vulnerability merits urgent attention despite moderate technical barriers to exploitation. The impact—complete admin lockout—is categorical and business-critical. Organizations should prioritize patching based on: (1) how widely the `users.edit` permission is distributed, (2) trust levels of current permission holders, and (3) the criticality of Snipe-IT to IT operations and compliance. High-trust environments may defer slightly, but broad permission distribution warrants immediate action.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects a network-accessible vulnerability requiring low-privilege authentication, causing high availability impact (denial of service to administrators) with minimal integrity risk. The base vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H balances the legitimate access requirement against the severe operational consequence. The score does not account for organizational context—actual risk varies with permission governance and system criticality.

Frequently asked questions