ZeroDay Findings
Sign inSign up

Findings

CVE-2026-44832

Snipe-IT is an IT asset/license management system.

Published May 26, 2026 · updated Jul 24, 2026 · snipeitapp snipe-it

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 26, 2026 · NIST NVD

    Detected

    Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update

  2. Jul 24, 2026 · NIST NVD

    Updated

    Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update

Affected

  • cpe snipeitapp/snipe-itversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-44832

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-44832

    Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the supe

    nvd.nist.gov

References