CVE-2026-85617 in Snipe-IT
Summary
by MITRE • 09/04/2026
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw resides within Snipe-IT, a popular open-source IT asset management system, specifically affecting versions prior to 8.6.3. This vulnerability is classified as an authorization bypass that targets the bulk delete functionality of the application. In secure software architecture, role-based access control mechanisms are designed to restrict user actions based on their assigned privileges and organizational scope. However, in this instance, the server-side validation logic fails to adequately verify whether a restricted or lower-privileged user has the authority to perform deletion operations on specific target entities. This lapse allows an attacker who possesses valid credentials for a limited role to manipulate API requests by including user identifiers that fall outside their permitted administrative domain.
Technically, the vulnerability exploits how the bulk delete endpoint processes input parameters without enforcing strict ownership or permission checks against each individual item in the request payload. When a user initiates a bulk deletion operation, they can supply an array of target user IDs. The application accepts these inputs and proceeds to execute soft-delete operations on all specified accounts regardless of whether the initiating user has jurisdiction over those specific accounts. This represents a classic case of broken access control where the system trusts client-supplied data regarding resource ownership without performing sufficient server-side authorization checks. By injecting unauthorized user identifiers into this request, an attacker can effectively bypass instance-level restrictions that are meant to isolate administrative duties and protect sensitive personnel records from lower-tier staff members.
The operational impact of this vulnerability is significant for organizations relying on Snipe-IT for managing their IT assets and employee data. An authenticated attacker with a restricted role could disable or soft-delete accounts belonging to administrators, managers, or other users outside their scope. This action can lead to service disruption by locking out critical personnel from the system, potentially causing operational downtime if key administrative functions are rendered inaccessible. Furthermore, since the deletion is often implemented as a soft delete in many asset management systems, there may be implications for data integrity and audit trails if recovery mechanisms are not robustly secured against such unauthorized actions. The ability to manipulate user states without proper authorization undermines the principle of least privilege and compromises the confidentiality and availability aspects of the system's security posture.
To mitigate this risk, organizations must immediately upgrade Snipe-IT to version 8.6.3 or later, where these access control checks have been corrected to ensure that users can only perform actions on resources they are explicitly authorized to manage. In environments where upgrading is not immediately feasible, temporary mitigations should include restricting API endpoint access through network-level controls such as firewalls or reverse proxies, limiting exposure of the bulk delete functionality to administrative roles only. Additionally, implementing strict input validation and ensuring that all server-side operations verify resource ownership against the current user's permissions can help prevent exploitation until a permanent patch is applied. Regular security audits and penetration testing focused on authorization flows are recommended to identify similar weaknesses in other modules of the application.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor obtaining privileges or accessing resources they should not be able to access due to a failure in enforcing role-based restrictions. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, where the attacker leverages legitimate credentials but abuses their permissions through flawed application logic rather than credential theft. Understanding these mappings helps security teams contextualize the threat within broader industry frameworks and prioritize remediation efforts based on standardized risk classifications.