CVE-2026-48507

Katalog CVE

CVSS 7.1 · High EPSS 0,42%

Kerentanan Incorrect Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

Rincian

Terbit di NVD

8 Juni 2026

Terakhir diubah

21 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a patch
• https://vokecyber.com/research/cve-2026-48507-snipe-it-admin-lockout