CyberRota Analysis
AI-GeneratedVersions of Snipe-IT prior to 8.6.3 are vulnerable to an authorization bypass in the bulk delete feature, enabling restricted users to soft-delete accounts beyond their permissions. This flaw allows attackers to manipulate or disable unauthorized user accounts, posing a significant risk to account integrity and security. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
Related CVEs
Other vulnerabilities affecting the same vendor(s)