Listen to this Post
Snipe-IT is an open-source IT asset and license management system. Prior to version 8.6.0, the application contained an improper privilege management vulnerability identified as CVE-2026-55843.
The root cause of this vulnerability lies in the `update()` method within the UsersController. This method passes the `permission` request field to `NormalizePermissionsPayloadAction` without any conditional checks. When the `permission` field is absent from the request, this action returns an empty array. Subsequently, this empty result is passed to PreserveUnauthorizedPrivilegedPermissionsAction. This action is designed to selectively restore only specific privileged keys to the permissions array—specifically, the `superuser` key (if the editor is not a superuser) and the `admin` key (if the editor is neither an admin nor a superuser).
The critical flaw emerges from this logic: all other permissions are discarded, and the `$user->permissions` attribute is overwritten with this sparse result. This includes the `admin` flag itself when the user performing the edit is an administrator.
The impact is severe due to the application’s authorization logic. The `canEditAuthFields` gate permits administrators to update other non-superuser accounts, which includes other administrators. Consequently, when an administrator sends a `PUT /users/{id}` request for another administrator and omits the `permission` field, the target user’s `admin` flag and all associated granular permissions are permanently destroyed. The target loses all administrative access without any error message, warning, or out-of-band notification.
A secondary, lower-impact attack vector exists for non-admin users who possess the `users.edit` permission. These users can target regular (non-admin, non-superuser) accounts and wipe all their granular permissions in the same manner. This vulnerability was patched in commit `1cff2d6` and the fix is included in Snipe-IT version 8.6.0.
DailyCVE Form:
Platform: Snipe-IT
Version: < 8.6.0
Vulnerability: Privilege Escalation
Severity: Medium
date: 2026-07-11
Prediction: 2026-07-15
What Undercode Say:
Check installed Snipe-IT version php artisan --version Verify the patch is applied (commit 1cff2d6) git log --oneline | grep 1cff2d6
Exploit: (Educational Purposes!)
Exploit scenario: Admin wiping another admin's permissions
curl -X PUT https://snipe-it.example.com/api/v1/users/{target_admin_id} \
-H "Authorization: Bearer {admin_token}" \
-H "Content-Type: application/json" \
-d '{"permissions": {}}'
Exploit scenario: Non-admin with users.edit wiping a regular user's permissions
curl -X PUT https://snipe-it.example.com/api/v1/users/{target_user_id} \
-H "Authorization: Bearer {users_edit_token}" \
-H "Content-Type: application/json" \
-d '{"permissions": {}}'
Protection:
1. Upgrade Snipe-IT to version 8.6.0 or later.
2. Apply the patch from commit `1cff2d67aabd00ee51d864c1d7fb717494c1d6ad`.
- Workaround: Ensure all `PUT /users/{id}` requests explicitly include the full, intended `permissions` object for the target user.
Impact:
- Admin account takeover: An administrator can inadvertently or maliciously strip another admin of all privileges.
- Permission loss: Granular permissions for non-admin users can be wiped by users with `users.edit` permission.
- Silent failure: The attack occurs without any error message or notification, making detection difficult.
- Privilege escalation (reverse): The vulnerability leads to a loss of privileges (downgrade) for the target user, not an elevation. This can be used as a denial-of-service attack against administrative accounts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
