SB2026060947 - Multiple vulnerabilities in snipe-it

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060947

SB2026060947 - Multiple vulnerabilities in snipe-it

Published: June 9, 2026 Updated: August 14, 2026

Security Bulletin ID SB2026060947
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-48507)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the bulk user editing functionality when modifying user account flags. A remote user can change the activated and ldap_import flags for other users to cause a denial of service.

The issue allows a user with only the granular users.edit permission to lock administrators out of the instance.


2) Improper access control (CVE-ID: CVE-2026-48493)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in the /api/v1/users/{their_own_id} API endpoint when processing PATCH requests for a user's own account. A remote privileged user can send a crafted PATCH request to grant themselves additional permissions and escalate privileges.

The issue allows assignment of permissions other than admin and superuser.


3) Improper access control (CVE-ID: CVE-2026-48492)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /api/v1/{object}/selectlist API endpoint when handling authenticated requests. A remote user can send a request to retrieve a paginated list of user accounts to disclose sensitive information.

The issue exposes usernames, display names, employee numbers, and user IDs for active accounts. If FMCS is disabled, all active accounts are exposed; if FMCS is enabled, exposure is limited to accounts within the same company.


4) Improper access control (CVE-ID: CVE-2026-49976)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over another user's account.

The vulnerability exists due to improper access control in the CSV user import update mode in UserImporter.php when processing a crafted CSV import. A remote privileged user can upload a CSV that overwrites a non-admin user's email address to take over another user's account.

Exploitation requires the import permission, and the issue affects non-admin, non-superuser target accounts.


5) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2026-49870)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass two-factor authentication and obtain a fully authenticated session.

The vulnerability exists due to improper access control in the POST /two-factor endpoint when processing TOTP verification requests. A remote user can submit unlimited TOTP guesses to bypass two-factor authentication and obtain a fully authenticated session.

If two-factor authentication is configured in optional mode, the account owner can disable two-factor authentication without OTP re-verification after login.


6) Improper access control (CVE-ID: CVE-2026-55542)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in S3 signature image retrieval when generating a temporary URL for a known signature filename. A remote user can request a signed S3 URL for another user's signature image to disclose sensitive information.

This issue affects S3-backed deployments and requires knowledge of a signature filename.


7) Improper privilege management (CVE-ID: CVE-2026-55843)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to remove administrative and granular permissions from another user account.

The vulnerability exists due to improper privilege management in the UsersController update() method when handling a PUT /users/{id} request without the permission field. A remote privileged user can send a crafted update request to remove administrative and granular permissions from another user account.

This issue occurs when editing another account that the caller is allowed to modify, and no error, warning, or out-of-band notification is generated when the target's permissions are destroyed.


8) Relative Path Traversal (CVE-ID: CVE-2026-55474)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in the displaySig action in ActionlogController when handling a filename parameter from the HTTP route. A remote user can supply a crafted filename to disclose sensitive information.

The issue can be exploited to read arbitrary files accessible to the web server process outside the intended private upload directory.


Remediation

Install update from vendor's website.

References