Authorization Flaw in Snipe-IT IT Asset Management System

CVE-2026-48493

What is CVE-2026-48493?

The vulnerability in Snipe-IT allows a user with limited permissions (users.edit) to exploit a flaw in the API. By sending a PATCH request to /api/v1/users/{their_own_id}, the user can grant themselves unnecessary permissions, such as creating assets or accessing reports. This flaw poses a significant risk as it permits unauthorized access to sensitive functionalities within the application. The issue has been addressed in version 8.6.0, making it crucial for users to update to this version to maintain security.

References