CVE-2026-48493: Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

June 23, 2026 (updated July 20, 2026)

A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.

References

github.com/advisories/GHSA-52fw-7fw2-fmv5
github.com/grokability/snipe-it/pull/19024
github.com/grokability/snipe-it/security/advisories/GHSA-52fw-7fw2-fmv5
nvd.nist.gov/vuln/detail/CVE-2026-48493

Code Behaviors & Features

Detect and mitigate CVE-2026-48493 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →