CVE-2026-44832 — Vulnerability in snipe/snipe-it — CVE Details

HIGH

Snipe-IT has Privilege Escalation via API Permissions Assignment

Published May 8, 2026Updated September 10, 2026Source: osv

Summary

### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users. ### Patches Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1 ### Workarounds None.

Advisory Timeline

First published May 8, 2026 (157 days ago).
Last revised September 10, 2026 — 124 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update snipe/snipe-it to 8.4.1 or later

composer require "snipe/snipe-it:^8.4.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
snipe/snipe-it	packagist	3.2.0, v0.1.0, v0.1.1, v0.1.2 (+270 more)	8.4.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-281
View on MITRE
CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-44832?: Snipe-IT has Privilege Escalation via API Permissions Assignment This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-44832?: CVE-2026-44832 affects snipe/snipe-it. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-44832 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hq28-crg7-95pr

Related CVEs

CVE-2026-37709
CRITICAL
Snipe-IT has insecure permissions in file uploads
CVE-2025-15602
HIGH
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
CVE-2026-63493
HIGH
Snipe-IT: 2FA bypass via the API token flow
CVE-2026-62368
HIGH
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
CVE-2026-54329
HIGH
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
CVE-2026-61807
MEDIUM
Snipe-IT: Stored DOM XSS via table selected-count IDs
CVE-2026-55466
MEDIUM
Snipe-IT vulnerable to stored XSS via inline-served attachment
CVE-2026-55481
MEDIUM
Snipe-IT has CSS Injection via `header_color` Setting

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies