GHSA-52fw-7fw2-fmv5
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | snipe/snipe-it | < 8.6.0 | 8.6.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc.
### Patches
Patched in https://github.com/grokability/snipe-it/pull/19024
References
External links from the advisory. They lead to third-party sites.