medium

CVE-2026-48493

Packagist · snipe/snipe-it

Summary

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Severity
medium
CVSS
5.5
EPSS
0.3% (p23)
CWE
CWE-863
Also known as
GHSA-52fw-7fw2-fmv5
Published
2026-06-23
Updated
2026-06-23

Advisory details

Impact

A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.

Patches

Patched in https://github.com/grokability/snipe-it/pull/19024

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.