CVE-2026-48493: Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{theirownid} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.
Patches Patched in https://github.com/grokability/snipe-it/pull/19024
Other sources
Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{theirownid} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc. The issue is patched in version 8.6.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.0 - Upgrade
Upgrade
grokability/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.0Patch pull/19024
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48493?
CVE-2026-48493 has a medium severity rating of 5.5.
What is the impact of CVE-2026-48493?
CVE-2026-48493 allows a user with specific permissions to escalate their privileges via the Snipe-IT API.
How do I fix CVE-2026-48493?
To resolve CVE-2026-48493, users should apply the patches provided in the repository.
Who is affected by CVE-2026-48493?
CVE-2026-48493 affects users of Snipe-IT who have the 'users.edit' and 'api' permissions.
What permissions can be granted through CVE-2026-48493?
Users can grant themselves various permissions except for admin and superuser through CVE-2026-48493.