---
id: CVE-2026-48493
title: >-
  Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions
  Assignment
summary: >-
  Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions
  Assignment
severity: medium
cvss: 5.5
cwe:
  - CWE-863
vendor: snipe
product: snipe/snipe-it
ecosystem: composer
affected:
  - snipe/snipe-it < 8.6.0
patched:
  - snipe/snipe-it 8.6.0
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-52fw-7fw2-fmv5'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-52fw-7fw2-fmv5
  - url: 'https://github.com/grokability/snipe-it/pull/19024'
  - url: 'https://github.com/advisories/GHSA-52fw-7fw2-fmv5'
tags:
  - ghsa
  - composer
epss: 0.00306
epssPercentile: 0.20803
ingestedAt: '2026-06-26T16:43:14.603Z'
---

## Overview

### Impact
A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc.

### Patches
Patched in https://github.com/grokability/snipe-it/pull/19024

## Affected packages

- `snipe/snipe-it < 8.6.0`

## Remediation

Upgrade to a patched release:

- `snipe/snipe-it 8.6.0`