Grokability Snipe-IT up to 8.6.0 Item Importer ItemImporter.php sanitizeItemForUpdating item privileges management

Summaryinfo

A vulnerability classified as critical has been found in Grokability Snipe-IT up to 8.6.0. This issue affects the function sanitizeItemForUpdating of the file app/Importer/ItemImporter.php of the component Item Importer. The manipulation of the argument item leads to privileges management. This vulnerability is uniquely identified as CVE-2026-49976. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Grokability Snipe-IT up to 8.6.0 and classified as critical. This issue affects the function sanitizeItemForUpdating of the file app/Importer/ItemImporter.php of the component Item Importer. The manipulation of the argument item with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-49976 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

By approaching the search of inurl:app/Importer/ItemImporter.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.6.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Grokability

Name

• Snipe-IT

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6.0

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion