GHSA-j5g3-42wp-gqm3: Medium severity composer/snipe/snipe-it vulnerability
Impact
The update() method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the superuser key (when the editor is not a superuser) and the admin key (when the editor is neither admin nor superuser). All other permissions — including the admin flag itself when the editing user is an admin — are discarded and $user->permissions is overwritten with the sparse result.
The canEditAuthFields gate permits admins to update other non-superuser accounts (including other admins). When an admin sends a PUT /users/{id} request for another admin without including the permission field, the target's admin flag and all granular permissions are permanently destroyed. The target loses administrative access entirely with no error, warning, or out-of-band notification.
A secondary, lower-impact path exists for non-admin users holding the users.edit permission: they may target regular (non-admin, non-superuser) accounts and wipe all granular permissions in the same way.
Patches Patched in https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.0 - Upgrade
Upgrade
grokability/snipe-itto a version that resolves this vulnerability.Patch 1cff2d67aabd00ee51d864c1d7fb717494c1d6ad
Event History
Frequently Asked Questions
Which users can trigger the higher-impact condition?
An authenticated administrator can update another administrator account through PUT /users/{id}. The editor cannot target a superuser through this path, but can target other non-superuser accounts, including other administrators.
What request condition causes permissions to be removed?
The requester omits the permission field when updating the target user. The application then overwrites the target's permissions with a sparse result, removing the target administrator flag and granular permissions.
Can non-administrators cause permission loss?
A non-administrator with the users.edit permission can target regular accounts that are neither administrators nor superusers. This lower-impact path can wipe all granular permissions from those accounts.
Will the affected user or administrator receive an alert when this happens?
No. The target loses administrative access or granular permissions without an error, warning, or out-of-band notification.