CyberRota Analysis
AI-GeneratedAn authenticated non-admin user in Snipe-IT versions prior to 8.6.2 can exploit a weakness in the BulkUsersController to soft-delete another non-admin user by sending a POST request to /users/bulksave with the delete_user parameter set to 1. This vulnerability could lead to unauthorized user management, potentially disrupting operations and access control. Organizations using Snipe-IT should prioritize updating to version 8.6.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)