CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.0 are vulnerable due to improper handling of permission requests in the UsersController::update() function, which can lead to unauthorized modification of user permissions. This flaw allows an administrator to inadvertently or maliciously overwrite another administrator's or a regular user's permissions, potentially stripping them of critical access rights. Organizations using affected versions should prioritize upgrading to 8.6.0 to mitigate the risk of privilege escalation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)