PT-2026-39300 · Grokability+2 · Snipe-It+1

Lorenzofradeani · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44832

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1

Description An authenticated user possessing only the users.edit permission can escalate their privileges to administrator. This occurs by sending a PATCH request to the '/api/v1/users/{id}' endpoint with the permissions[admin] variable set to 1. The API controller fails to properly validate the permissions array, stripping only the superuser key while allowing the admin and other permission keys to be modified by any user with update capabilities.

Recommendations Update to version 8.4.1.

Fix

LPE

Improper Preservation of Permissions

Incorrect Authorization

Weakness Enumeration

CWE-281

CWE-863

Related Identifiers

CVE-2026-44832

GHSA-HQ28-CRG7-95PR

Affected Products

Snipe-It

Snipe/Snipe-It

References · 6

• https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr · Vendor Advisory
• https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569 · Patch
• https://osv.dev/vulnerability/GHSA-hq28-crg7-95pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44832 · Security Note
• https://github.com/grokability/snipe-it · Note
• https://t.me/CVEtracker/55018 · Telegram Post