HIGH🇬🇧 English

CVE-2026-44832

CVSS 8.7v4.0pub. 2026-05-26upd. 2026-07-02

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Snipeitapp Snipe It

    APP
    Snipeitapp
    < 8.4.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2026-37709CRITICAL9.8PL ✓ten sam produkt

RCE w Snipe-IT — Insecure Permissions w API uploadu plików

CVE-2025-63601CRITICAL9.9PL ✓ten sam produkt

RCE w Snipe-IT via złośliwy plik backup (CVE-2025-63601)

CVE-2026-48507HIGH7.1ten sam produkt

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-adm...

CVE-2025-15602HIGH8.7ten sam produkt

Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insu...

CVE-2024-51093HIGH8.7ten sam produkt

Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious...