GHSA-j5g3-42wp-gqm3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-j5g3-42wp-gqm3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j5g3-42wp-gqm3/GHSA-j5g3-42wp-gqm3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-j5g3-42wp-gqm3
- Aliases
- Published
- 2026-08-28T22:37:24Z
- Modified
- 2026-08-28T22:45:06Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Snipe-IT has an Improper Privilege Management issue
- Details
-
Impact
The
update()method inUsersControllerpasses thepermissionrequest field unconditionally toNormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed toPreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only thesuperuserkey (when the editor is not a superuser) and theadminkey (when the editor is neither admin nor superuser). All other permissions — including theadminflag itself when the editing user is an admin — are discarded and$user->permissionsis overwritten with the sparse result.The
canEditAuthFieldsgate permits admins to update other non-superuser accounts (including other admins). When an admin sends aPUT /users/{id}request for another admin without including thepermissionfield, the target'sadminflag and all granular permissions are permanently destroyed. The target loses administrative access entirely with no error, warning, or out-of-band notification.A secondary, lower-impact path exists for non-admin users holding the
users.editpermission: they may target regular (non-admin, non-superuser) accounts and wipe all granular permissions in the same way.Patches
Patched in https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad
- Database specific
{ "cwe_ids": [ "CWE-269" ], "github_reviewed": true, "github_reviewed_at": "2026-08-28T22:37:24Z", "nvd_published_at": "2026-07-10T19:17:26Z", "severity": "HIGH" }- References
-
- https://github.com/grokability/snipe-it/security/advisories/GHSA-j5g3-42wp-gqm3
- https://nvd.nist.gov/vuln/detail/CVE-2026-55843
- https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad
- https://github.com/grokability/snipe-it
- https://github.com/grokability/snipe-it/releases/tag/v8.6.0
Affected packages
Packagist / snipe/snipe-it
Package
- Name
- snipe/snipe-it
- Purl
- pkg:composer/snipe/snipe-it
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.6.0