CVE-2026-48507

HIGH EPSS 9.3%
Published Jun 8, 20263w ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Jun 8, 2026 3w ago
Last Modified Jun 17, 2026 1w ago

Description

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

CVSS Details

Base Score
7.1
Exploitability
2.8
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability High

Threat Intelligence

EPSS Exploit Probability
9.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
snipeitappsnipe-it* <8.6.0

References 2

  • github.com https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
    Patch
  • github.com https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr
    PatchVendor Advisory

Remediation

  • github.com https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
    Patch
  • github.com https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr
    PatchVendor Advisory