CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.2 are vulnerable to improper authorization in the API endpoint for managing licenses, allowing low-privilege users to bind unauthorized licenses to kits. This could lead to unauthorized access and manipulation of license management, potentially compromising asset integrity. Organizations using Snipe-IT should prioritize upgrading to version 8.6.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)