CVE-2026-48493

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0

Description A user possessing users.edit and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as assets.view, assets.create, reports.view, and import capabilities, although they cannot grant themselves admin or superuser status.

Recommendations Update to version 8.6.0.