Authorization Bypass Vulnerability in Snipe-IT by Grokability

CVE-2026-85617

What is CVE-2026-85617?

The Snipe-IT application prior to version 8.6.3 contains an authorization bypass vulnerability that affects its bulk delete functionality. This flaw allows restricted users to execute bulk delete actions on user accounts that are beyond their authorized scope. Attackers can exploit this vulnerability by including unauthorized user IDs in their bulk delete requests, effectively circumventing instance-level restrictions. Consequently, this could allow unauthorized modification or disabling of accounts that should be inaccessible, posing a serious security risk for organizations utilizing this software.

References