CVE-2026-48507 json
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
published 2026-06-08 5 mo ago modified 2026-08-21 2 mo ago also EUVD-2026-35140 , GHSA-6f75-x745-xcpr
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.
Patch / fix
- packagist snipe/snipe-it 8.6.0
- snipeitapp snipe-it 8.6.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | snipe/snipe-it | <8.6.0 |
8.6.0 |
Affected products
- grokability snipe-it
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
web, patch
-
github.com
/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr
web, patch, vendor-advisory
-
vokecyber.com
/research/cve-2026-48507-snipe-it-admin-lockout
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-48507
advisory
-
github.com
/grokability/snipe-it
package
Sources
- CVE List CVE-2026-48507
- GitHub Advisory GHSA-6f75-x745-xcpr
- NVD CVE-2026-48507
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.