GHSA-8frh-vhgh-64cf: Composer/snipe/snipe-it vulnerability
Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat that is currently assigned to another user or asset.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the checkout permission who does not have the checkin permission can exploit the legacy single-seat checkin endpoint. Such a user can reclaim a license seat assigned to another user or asset.
What authorization condition makes an installation exposed?
The installation is exposed where users are permitted to assign licenses through the checkout permission but are not permitted to unassign them through the checkin permission, and can directly access the legacy checkin flow.
What should be reviewed if patching cannot happen immediately?
Review users and roles that have the checkout permission without the checkin permission, as these users can use the legacy endpoint to reclaim assigned license seats. Restricting checkout access for affected roles reduces exposure.