CVE-2026-85617: snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.6.3 - Compensating control
Until upgraded, restrict access to the Snipe-IT bulk delete functionality to only trusted/authorized users (e.g., via application access controls and/or administrative role enforcement).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated restricted user with access to the bulk delete functionality can exploit it. No user interaction is required, and the attack can be performed over the network.
What does an attacker need to do to bypass the restriction?
The attacker must include user IDs outside their authorized scope in a bulk delete request. This can soft-delete unauthorized users and modify or disable accounts the attacker should not be able to access.
Which versions should be remediated?
Snipe-IT versions before 8.6.3 are affected. Upgrade to 8.6.3 or later to address the vulnerable bulk delete behavior.