Iltosec

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions prior to 8.6.0 **Description** A user possessing `users.edit` and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as `assets.view`, `assets.create`, `reports.view`, and import capabilities, although they cannot grant themselves admin or superuser status. **Recommendations** Update to version 8.6.0.