PT-2026-51606 · Snipe-It · Snipe-It

Iltosec + 1 · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-48493

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0

Description A user possessing users.edit and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as assets.view, assets.create, reports.view, and import capabilities, although they cannot grant themselves admin or superuser status.

Recommendations Update to version 8.6.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-48493

GHSA-52FW-7FW2-FMV5

Affected Products

Snipe-It

References · 5

• https://osv.dev/vulnerability/GHSA-52fw-7fw2-fmv5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48493 · Security Note
• https://github.com/grokability/snipe-it · Note
• https://github.com/grokability/snipe-it/security/advisories/GHSA-52fw-7fw2-fmv5 · Note
• https://github.com/grokability/snipe-it/pull/19024 · Note