PT-2026-47386 · Snipe-It · Snipe-It

CVE-2026-48507

·

Published

2026-06-08

·

Updated

2026-08-21

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0
Description An issue in this IT asset and license management system allows a non-admin user with the users.edit permission to lock all administrators out of the instance. This is achieved by modifying the activated flag, which controls login access, and the ldap import flag, which determines if a user can request a password reset.
Recommendations Update to version 8.6.0.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-48507
GHSA-6F75-X745-XCPR

Affected Products

Snipe-It