CVE-2024-5685

Name of the Vulnerable Software and Affected Versions: snipe-it versions 4.6.17 through 6.4.1

Description: The issue allows users with User:edit and Self:api permissions to promote or demote themselves or other users by performing changes to the group's memberships via an API call.

Recommendations: For versions 4.6.17 through 6.4.1, consider restricting the User:edit and Self:api permissions to prevent unauthorized changes to group memberships until a patch is available. As a temporary workaround, consider disabling API calls that allow group membership changes to minimize the risk of exploitation.