---
id: CVE-2026-48507
title: >-
  Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk
  editing users
summary: >-
  Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk
  editing users
severity: high
cvss: 7.1
cwe:
  - CWE-863
vendor: snipe
product: snipe/snipe-it
ecosystem: composer
affected:
  - snipe/snipe-it < 8.6.0
patched:
  - snipe/snipe-it 8.6.0
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6f75-x745-xcpr'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48507'
  - url: >-
      https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
  - url: 'https://github.com/advisories/GHSA-6f75-x745-xcpr'
tags:
  - ghsa
  - composer
epss: 0.00422
epssPercentile: 0.33883
ingestedAt: '2026-06-26T16:43:14.597Z'
---

## Overview

### Impact
The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance  by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.

### Patches
Patched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a

## Affected packages

- `snipe/snipe-it < 8.6.0`

## Remediation

Upgrade to a patched release:

- `snipe/snipe-it 8.6.0`