CVE-2026-55460: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55460 Overview

CVE-2026-55460 is a broken authorization vulnerability in Snipe-IT, an open-source IT asset and license management system. Versions prior to 8.6.2 allow authenticated non-admin users holding users.view and users.edit permissions to soft-delete other non-admin users without holding users.delete. The flaw resides in BulkUsersController::destroy(), which authorizes only the update action while accepting a delete_user=1 parameter in POST requests to /users/bulksave. This missing permission check ([CWE-863]) enables privilege escalation of user management actions. The issue is fixed in Snipe-IT 8.6.2.

Critical Impact
Authenticated users lacking delete permissions can soft-delete other non-admin accounts, disrupting user access and integrity of the asset management system.

Affected Products

Snipe-IT versions prior to 8.6.2
Snipe-IT self-hosted deployments
Snipe-IT Docker container distributions

Discovery Timeline

2026-07-10 - CVE-2026-55460 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55460

Vulnerability Analysis

Snipe-IT exposes a bulk user operations endpoint at /users/bulksave, handled by the BulkUsersController class. The controller's destroy() method processes bulk actions including checkin of assets, licenses, and accessories, as well as optional user deletion when the delete_user field is set to 1. Before the patch, the method invoked only the update gate check against the User model. Any authenticated user holding users.view and users.edit permissions could reach the endpoint and trigger user soft-deletion. The users.delete permission was never evaluated, breaking the intended separation between user editing and user deletion privileges.

Root Cause

The root cause is missing authorization ([CWE-863]) in BulkUsersController::destroy(). The controller authorized the wrong action for a distinct destructive operation. Delete capability was implicitly granted to any principal with update capability, violating least privilege. The patch adds an explicit gate check requiring the delete ability on the User class whenever delete_user=1 is submitted. It also adds per-item checkin gate checks for assets, licenses, and accessories to enforce company-scoping.

Attack Vector

An authenticated non-admin user with users.view and users.edit submits a crafted POST to /users/bulksave with delete_user=1 and a target user ID. The server executes the soft-delete against the target account without verifying users.delete. The attack requires only network access and low privileges, with no user interaction.

php

// Security patch in app/Http/Controllers/Users/BulkUsersController.php
// Enforce per-item checkin permissions before touching anything (catches FMCS company scoping).
foreach ($assets as $asset) {
    if (auth()->user()->cannot('checkin', $asset)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

$licenseModels = License::whereIn('id', $licenses->pluck('license_id')->unique())->get();
foreach ($licenseModels as $license) {
    if (auth()->user()->cannot('checkin', $license)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

$accessoryModels = Accessory::whereIn('id', $accessoryUserRows->pluck('accessory_id')->unique())->get();
foreach ($accessoryModels as $accessory) {
    if (auth()->user()->cannot('checkin', $accessory)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

// Require delete permission before allowing user deletion.
if ($request->input('delete_user') == '1' && auth()->user()->cannot('delete', User::class)) {
    return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
}

Source: GitHub Commit 374f426

Detection Methods for CVE-2026-55460

Indicators of Compromise

POST requests to /users/bulksave containing the delete_user=1 parameter submitted by accounts without administrator role.
Unexpected soft-deleted user rows in the Snipe-IT users table where deleted_at is populated by non-admin actor IDs.
Snipe-IT activity log entries showing bulk user delete events initiated by users lacking the users.delete permission.

Detection Strategies

Review Snipe-IT application logs and web server access logs for POST calls to /users/bulksave and correlate the acting user's permission set with the requested action.
Query the database for recently soft-deleted user records and cross-reference with the actor's assigned permissions in the permissions field.
Alert on any bulk user operations originating from accounts that only hold users.view and users.edit.

Monitoring Recommendations

Forward Snipe-IT web and application logs to a centralized log platform for retention and correlation.
Track HTTP request patterns to /users/bulksave and baseline normal administrator behavior to surface anomalies.
Monitor for spikes in soft-delete operations against user records outside of scheduled cleanup windows.

How to Mitigate CVE-2026-55460

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later without delay.
Audit all user accounts and review permission assignments, revoking users.edit from principals that do not require it.
Review the users table for unauthorized soft-deletes and restore accounts as needed using the built-in restore functionality.

Patch Information

The vulnerability is fixed in Snipe-IT 8.6.2. The fix, published in commit 374f426f0c6bb7a4f129f7b85051cc1da753a0f5, adds explicit delete gate authorization for user deletion and per-item checkin gate checks for assets, licenses, and accessories. Refer to the GitHub Security Advisory GHSA-vgx7-c78r-69w9 and the GitHub Release v8.6.2 for release notes.

Workarounds

If immediate patching is not possible, remove the users.edit permission from all non-administrator accounts until the upgrade is deployed.
Restrict network access to the Snipe-IT /users/bulksave endpoint via reverse proxy or web application firewall rules limited to trusted administrator IP ranges.
Enable enhanced logging around bulk user operations to enable rapid response if abuse occurs.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear