Loading...
Skip to main content
GeekWala

CVE-2026-44832

HIGH

Snipe-IT has Privilege Escalation via API Permissions Assignment

Published May 8, 2026Updated July 2, 2026Source: osv

Summary

### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users. ### Patches Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1 ### Workarounds None.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update snipe/snipe-it to 8.4.1 or later
composer require "snipe/snipe-it:^8.4.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
snipe/snipe-it
packagist
3.2.0, v0.1.0, v0.1.1, v0.1.2 (+270 more)8.4.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-44832?
Snipe-IT has Privilege Escalation via API Permissions Assignment This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-44832?
CVE-2026-44832 affects snipe/snipe-it. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-44832 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hq28-crg7-95pr

Related CVEs

  • CVE-2026-37709
    CRITICAL

    Snipe-IT has insecure permissions in file uploads

  • CVE-2026-64679
    HIGH

    Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

  • CVE-2025-15602
    HIGH

    Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

  • CVE-2026-63135
    HIGH

    YOURLS has stored XSS in referrer statistics chart via crafted Referer header

  • CVE-2026-54178
    HIGH

    Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

  • CVE-2026-54182
    HIGH

    Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

  • CVE-2026-54329
    HIGH

    Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

  • CVE-2026-61807
    MEDIUM

    Snipe-IT: Stored DOM XSS via table selected-count IDs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies