HIGH8.8

GHSA-hq28-crg7-95pr

Snipe-IT has Privilege Escalation via API Permissions Assignment

Quick fix

GHSA-hq28-crg7-95pr — snipe/snipe-it: upgrade to the fixed version with the command below.

composer require snipe/snipe-it:^8.4.1

Details

### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users.

### Patches Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1

### Workarounds None.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/snipe/snipe-it

Introduced in: 0Fixed in: 8.4.1

Fixcomposer require snipe/snipe-it:^8.4.1

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-44832[ADVISORY]
https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569[WEB]
https://github.com/grokability/snipe-it[PACKAGE]