CVE-2026-48492 json
Snipe-IT's selectlist visibility is too permissive
published 2026-06-23 4 mo ago modified 2026-10-25 14 d ago also GHSA-f3c5-6cw8-fg57 , EUVD-2026-42433
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
Patch / fix
- packagist snipe/snipe-it 8.5.1
- snipeitapp snipe-it 8.6.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 4.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | snipe/snipe-it | <8.5.1 |
8.5.1 |
Affected products
- grokability snipe-it
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f
web, patch
-
github.com
/grokability/snipe-it/security/advisories/GHSA-f3c5-6cw8-fg57
web, patch, vendor-advisory
-
github.com
/grokability/snipe-it
package
Sources
- CVE List CVE-2026-48492
- GitHub Advisory GHSA-f3c5-6cw8-fg57
- NVD CVE-2026-48492
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.