CVE-2026-49976

MediumCVSS 6.5/10Last modified Sep 30, 2026

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
grokability	snipe-it	< 8.6.1

References

https://github.com/grokability/snipe-it/commit/dd4117bd5be59766c22767717ec403dfdece1e19Patch
https://github.com/grokability/snipe-it/pull/19072Patch
https://github.com/grokability/snipe-it/releases/tag/v8.6.1Release Notes, Patch
https://github.com/grokability/snipe-it/security/advisories/GHSA-p68w-rgmg-3c2vExploit, Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-499774.3tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with th CVE-2026-499786.1DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip CVE-2026-499792.7Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint CVE-2026-49987.3A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file CVE-2026-499809.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclo CVE-2026-499818.2Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Templ CVE-2026-499828.2tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values t CVE-2026-499835.2Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny i CVE-2026-499847.7Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user CVE-2026-499867.1The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DI CVE-2026-499878.8Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the CVE-2026-499885.5Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repo