CVE-2026-85617 Overview
CVE-2026-85617 is an authorization bypass vulnerability in Snipe-IT, an open-source IT asset management application. Versions before 8.6.3 fail to enforce instance-level scope checks in the bulk delete endpoint for users. Restricted operators can include user IDs outside their authorized scope in a bulk delete request and soft-delete those accounts. The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
An authenticated user with limited privileges can disable or remove arbitrary user accounts across the Snipe-IT instance, breaking tenancy boundaries and enabling account takeover-adjacent impact.
Affected Products
- Snipe-IT (grokability/snipe-it) versions prior to 8.6.3
- Deployments using multi-instance or scoped-user restrictions
- Self-hosted and containerized Snipe-IT installations on the affected release line
Discovery Timeline
- 2026-09-04 - CVE-2026-85617 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85617
Vulnerability Analysis
Snipe-IT supports scoped administrative roles that limit which users an operator can view or modify. The bulk delete workflow for users accepts an array of user identifiers submitted by the client. In vulnerable releases, the server-side handler iterates the submitted IDs and performs a soft-delete without re-validating that each target belongs to the caller's authorized scope.
A restricted user who understands the request structure can enumerate or guess additional user IDs and append them to a legitimate bulk request. The application processes every ID as though the caller were authorized to act on it. Soft-deleted accounts lose access to the platform and any workflows dependent on them, including asset check-outs, approvals, and audit responsibilities.
The issue is classified as CWE-639 because authorization decisions rely on a user-controlled key without verifying that the caller is entitled to reference it.
Root Cause
The root cause is missing per-item authorization inside the bulk delete controller. Scope checks occur at the request or view layer but not for each identifier processed by the delete loop. The permission model assumes the client only submits IDs it is allowed to see, which is not enforceable server-side.
Attack Vector
Exploitation requires an authenticated session with at least a low-privileged, scoped account. The attacker crafts an HTTP POST to the bulk users delete endpoint and includes IDs of users outside their scope alongside any in-scope IDs. No user interaction from the victim is required, and the attack is delivered over the network.
No public proof-of-concept exploit code is available. Refer to the GitHub Security Advisory GHSA-mx3g-8v84-j6gg and the VulnCheck Authorization Bypass Advisory for additional technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-85617
Indicators of Compromise
- Unexpected deleted_at timestamps on user records that were not administratively removed by authorized operators.
- Bulk delete requests to the users endpoint containing IDs outside the caller's normal working set.
- Audit log entries showing user deletions performed by accounts that lack global administrator rights.
- Sudden loss of access reported by users who were not scheduled for offboarding.
Detection Strategies
- Compare submitted user IDs in bulk delete HTTP requests against the caller's role or instance scope, and alert on mismatches.
- Review Snipe-IT application logs for bulk user actions initiated by non-superadmin accounts.
- Query the users table for records where deleted_at was set within a short window by the same actor across disparate scopes.
Monitoring Recommendations
- Enable verbose audit logging for user administration endpoints and forward logs to a centralized SIEM.
- Alert on any HTTP request to bulk user management routes that includes more than a small threshold of IDs.
- Track deletion volume per operator account and flag deviations from historical baselines.
How to Mitigate CVE-2026-85617
Immediate Actions Required
- Upgrade Snipe-IT to version 8.6.3 or later without delay.
- Audit user records for unexpected soft-deletes and restore accounts as needed by clearing the deleted_at column.
- Rotate credentials and API tokens for any accounts affected by unauthorized deletion.
- Review recent audit logs for bulk user delete activity performed by scoped or restricted accounts.
Patch Information
The maintainers fixed the vulnerability in Snipe-IT 8.6.3. The patch enforces per-record scope validation inside the bulk delete handler so that user IDs outside the caller's authorized scope are rejected. Refer to the GitHub Security Advisory GHSA-mx3g-8v84-j6gg for release notes.
Workarounds
- Temporarily restrict access to the bulk delete route at the reverse proxy or web application firewall for non-administrative users until the upgrade is applied.
- Reduce the number of accounts granted user management permissions to the minimum required.
- Require multi-factor authentication for all administrative and scoped operator accounts to raise the bar for account compromise.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
