CVE-2026-48507

Summary

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Severity

high

CVSS

7.1

EPSS

0.2% (p14)

CWE

CWE-863

Also known as

GHSA-6f75-x745-xcpr

Published

2026-06-23

Updated

2026-06-23

Advisory details

Impact

The vulnerability allows a non-admin user holding only the granular users.edit permission to lock every admin out of the instance by editing the activated flag (which determines whether or not a user can login) and the ldap_import flag, which determines whether or not the user can request a password reset.

Patches

Patched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a

References

• https://github.com/advisories/GHSA-6f75-x745-xcpr
• https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr
• https://nvd.nist.gov/vuln/detail/CVE-2026-48507
• https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a

Related advisories

• CVE-2026-55460 — high · Packagist/snipe/snipe-it
• CVE-2026-55479 — medium · Packagist/snipe/snipe-it
• CVE-2026-55475 — medium · Packagist/snipe/snipe-it
• CVE-2026-55472 — medium · Packagist/snipe/snipe-it
• CVE-2026-55462 — medium · Packagist/snipe/snipe-it
• CVE-2026-55843 — high · Packagist/snipe/snipe-it
• CVE-2026-55516 — high · Packagist/snipe/snipe-it
• CVE-2026-55474 — high · Packagist/snipe/snipe-it

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity