GHSA-crv3-j83j-f3r6: Composer/snipe/snipe-it vulnerability
Impact The API endpoint for adding a license to a predefined kit (POST /api/v1/kits/{kitid}/licenses) only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit permissions can still bind a license that they should not be allowed to access or manage into a kit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2
Event History
Frequently Asked Questions
Who can exploit this authorization flaw?
A low-privilege user who has permission to edit predefined kits can exploit it. They do not need permission to access or manage the specific license they reference.
What access is required to trigger the issue?
The caller needs access to the API endpoint for adding licenses to predefined kits and permission to edit kits. The vulnerable operation is POST /api/v1/kits/{kit_id}/licenses.
What is the impact of successful exploitation?
An authorized kit editor can bind a license they are not authorized to access or manage to a predefined kit. This bypasses object-level authorization for the referenced license.