Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

高 8.8CVE-2026-55483 · GHSA-hf68-g98v-wp9g · 19/08/2026 公開 · 30/09/2026 更新

要点

CVE-2026-55483 は snipe/snipe-it, snipe-it (snipeitapp) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.35%（全脆弱性の 28.6% より高い）。
対処：8.6.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
snipe/snipe-it Packagist	`< 8.6.0`	`8.6.0`
snipe-it snipeitapp	`< 8.6.0`	`8.6.0`

概要

Impact

The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.

The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.

Patches

Patched in aea3877718

NVD の説明

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.