PT-2026-51643 · Packagist · Snipe/Snipe-It

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-55483

OSV

CVSS v4.0

4.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Impact

The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.

The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.

Patches

Patched in aea3877718

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-55483

GHSA-HF68-G98V-WP9G

Produtos afetados

Snipe/Snipe-It

Referências · 4

• https://github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g · Nota
• https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb · Nota
• https://github.com/grokability/snipe-it · Nota
• https://osv.dev/vulnerability/GHSA-hf68-g98v-wp9g · Aviso do Fabricante