CVE-2026-49976

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.1

Description An improper access control issue exists in the CSV user import functionality when used in update mode. A user granted the import permission can overwrite the email address of any non-admin user by uploading a specially crafted CSV file. This allows the attacker to subsequently request a password reset and take over the targeted account. The flaw occurs because the sanitizeItemForUpdating() function in app/Importer/ItemImporter.php rebuilds the update array from the raw CSV data stored in $this->item rather than using the sanitized model attributes. Consequently, the security checks performed in app/Importer/UserImporter.php via the canEditAuthFields gate are bypassed. Additionally, the import path in app/Http/Controllers/ImportController.php only verifies the import permission and fails to require the users.edit permission.

Recommendations Update to version 8.6.1.