{"id":"CVE-2026-48507","title":"Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users","summary":"Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users","severity":"high","cvss":7.1,"cwe":["CWE-863"],"vendor":"snipe","product":"snipe/snipe-it","ecosystem":"composer","affected":["snipe/snipe-it < 8.6.0"],"patched":["snipe/snipe-it 8.6.0"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6f75-x745-xcpr","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48507"},{"url":"https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a"},{"url":"https://github.com/advisories/GHSA-6f75-x745-xcpr"}],"tags":["ghsa","composer"],"epss":0.00422,"epssPercentile":0.33883,"ingestedAt":"2026-06-26T16:43:14.597Z","slug":"CVE-2026-48507","body":"## Overview\n\n### Impact\nThe vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance  by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a\n\n## Affected packages\n\n- `snipe/snipe-it < 8.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snipe/snipe-it 8.6.0`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}