Vulnerability Description
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Snipeitapp | Snipe-It | < 8.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d4Patch
- https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95prPatchVendor Advisory
FAQ
What is CVE-2026-44832?
CVE-2026-44832 is a vulnerability with a CVSS score of 8.8 (HIGH). Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/...
How severe is CVE-2026-44832?
CVE-2026-44832 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44832?
Check the references section above for vendor advisories and patch information. Affected products include: Snipeitapp Snipe-It.