Sign in
Deutsch English Español Polski
Medium

Snipe-IT's selectlist visibility is too permissive

  • Disclosed: 23.06.2026
  • Updated: 11.10.2026 10:22

Impact

The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled.

What an attacker can do with a valid login and zero permissions:

  • Enumerate all active user accounts by paginating through the endpoint
  • Harvest usernames for credential stuffing or password spray attacks
  • Collect employee numbers and full names for social engineering
  • Perform indirect email enumeration via the search parameter
  • Map user IDs for use in further enumeration against other endpoints

This vulnerability is exploitable only by users who have a working login to the Snipe-IT system.

Patches

https://github.com/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package snipe/snipe-it < 8.5.1 8.5.1

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness (CWE)
CWE-862
Platform
Composer
Package
snipe/snipe-it
Disclosed
23.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f3c5-6cw8-fg57 - CC BY 4.0

Vulnerability history: snipe/snipe-it

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (81) in the archive
Total entries
81
First → latest
10.2021 09.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 23
  • Medium 53
  • Low 4

Disclosures per year

Severity:
  1. Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
    High · 8.7 CVE-2026-63498 < 8.7.0 8.7.0
  2. Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
    High · 8.1 CVE-2026-62368 < 8.7.0 8.7.0
  3. Snipe-IT: 2FA bypass via the API token flow
    High CVE-2026-63493 < 8.7.0 8.7.0
  4. Snipe-IT has an Improper Privilege Management issue
    High · 6.5 CVE-2026-55843 < 8.6.0 8.6.0
  5. Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
    High · 7.7 CVE-2026-55516 < 8.6.2 8.6.2
  6. Snipe-IT vulnerable to directory traversal in displaySig
    High CVE-2026-55474 < 8.5.0 8.5.0
  7. Snipe-IT has an authorization bypass on bulk editing users
    High · 7.1 CVE-2026-55460 < 8.6.2 8.6.2
  8. Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
    High CVE-2026-55694 < 8.6.3 8.6.3
  9. Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
    High CVE-2026-55643 < 8.6.3 8.6.3
  10. Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
    High · 8.5 CVE-2026-54329 < 8.6.2 8.6.2
  11. Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
    High · 7.1 CVE-2026-48507 < 8.6.0 8.6.0
  12. Snipe-IT's selectlist visibility is too permissive this entry
    Medium CVE-2026-48492 < 8.5.1 8.5.1
  13. Snipe-IT has insecure permissions in file uploads
    Critical · 9.8 CVE-2026-37709 < 8.4.1 8.4.1
  14. Snipe-IT has Privilege Escalation via API Permissions Assignment
    High · 8.8 CVE-2026-44832 < 8.4.1 8.4.1
  15. Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
    High · 8.8 CVE-2025-15602 < 8.3.7 8.3.7
  16. Cross Site Scripting vulnerability in Snipe-IT
    High · 8.7 CVE-2024-51093 <= 7.0.13 no fix
  17. Snipe-IT remote code execution
    High · 7.2 CVE-2024-48987 < 7.0.10 7.0.10
  18. Snipe-IT allows users to promote or demote themselves or other users
    High · 8.1 CVE-2024-5685 < 6.4.2 6.4.2
  19. Cross-Site Request Forgery (CSRF) in snipe/snipe-it
    High · 8.8 CVE-2023-5511 < 6.2.3 6.2.3
  20. snipe-IT vulnerable to host header injection
    High · 8.8 CVE-2022-23064 >= 3.0-alpha, < 5.3.8 5.3.8
  21. Old sessions not blocked by login enable function in Snipe-IT
    High · 7.4 CVE-2022-1155 >= 6.0.0-RC-1, < 6.0.0-RC-6, < 5.4.2 6.0.0-RC-6, 5.4.2
  22. Improper Privilege Management in Snipe-IT
    High · 8.8 CVE-2022-0611 < 5.3.11 5.3.11
  23. snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2021-4130 < 5.3.6 5.3.6
  24. Server-Side Request Forgery in snipe/snipe-it
    High · 7.2 CVE-2021-4075 < 6.0.0-GM 6.0.0-GM
  25. Cross-site Scripting in snipe/snipe-it
    High · 8.0 CVE-2021-3961 < 5.3.2 5.3.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.