{"id":"CVE-2026-50550","title":"Snipe-IT is an IT asset/license management system","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","cwe":["CWE-863","CWE-862"],"vendor":"snipe","product":"snipe/snipe-it","affected":["snipe/snipe-it < 8.5.0"],"patched":["snipe/snipe-it 8.5.0"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:19:49.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50550","references":[{"url":"https://github.com/grokability/snipe-it/commit/046ef82c6501be14df597f0bf5d0de2566c7d6bc","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.5.0","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-6x4j-8954-5hxm"}],"tags":["nvd","ghsa","composer"],"epss":0.00176,"epssPercentile":0.0743,"ecosystem":"composer","ingestedAt":"2026-06-26T16:43:14.586Z","slug":"CVE-2026-50550","body":"## Overview\n\nSnipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50550)\n\nAffected packages:\n\n- `snipe/snipe-it < 8.5.0`\n\nPatched in:\n\n- `snipe/snipe-it 8.5.0`\n\nSource: https://github.com/advisories/GHSA-6x4j-8954-5hxm","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}