Vulnerability-Lookup

GHSA-FC33-6W3Q-538H

Vulnerability from github – Published: 2026-08-28 17:57 – Updated: 2026-08-28 17:57

Summary

Snipe-IT has an authorization bypass on print inventory page

Details

Impact

An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license names, purchase order/order values, accessory and consumable names, assignment notes, and purchase costs.

Attacker Model

Authenticated user with only:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json {"users.view":"1"}


The attacker does not have:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json
{
  "licenses.view": "1",
  "accessories.view": "1",
  "consumables.view": "1",
  "assets.view": "1"
}

Affected Component

app/Http/Controllers/Users/UsersController.php
resources/views/users/view.blade.php
resources/views/users/print.blade.php
Endpoints:
- GET /users/{user}
- GET /users/{user}/print

Root Cause

UsersController::show() authorizes only viewing the user, then loads inventory relationships:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ php $this->authorize('view', $user);

$user = User::with([ 'consumables', 'accessories', 'licenses', 'userloc', 'groups', ])


`resources/views/users/view.blade.php` renders those relationships without checking the corresponding module permissions. The license table renders name, purchase cost, purchase order, and order number. The accessory and consumable tables render item names, notes, and unit costs.

`UsersController::printInventory()` similarly authorizes only `view` on `User::class` and the target user, then renders `resources/views/users/print.blade.php`, which outputs assigned inventory names.

### Proof of Concept

1.  Create a user with only `users.view`.

2.  Create a target user with assigned license/accessory/consumable records containing recognizable test values.

3.  Log in as the `users.view`-only user.

4.  Confirm direct module access is denied:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /licenses
GET /accessories
GET /consumables

Observed for each:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 403 Forbidden


1.  Request the target user's page:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /users/<target-user-id> HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>

Observed:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 200 OK


The response contained assigned inventory data from modules the attacker could not directly access, including license name, purchase order/order values, accessory name/note/cost, and consumable name/note/cost.

1.  Request the print view:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /users/<target-user-id>/print HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>

Observed:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 200 OK


The response contained assigned inventory names.

### Evidence

The `users.view`-only test account was confirmed to lack direct inventory permissions:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json
{
  "has_users_view": true,
  "has_licenses_view": false,
  "has_accessories_view": false,
  "has_consumables_view": false,
  "has_assets_view": false
}

Direct access to /licenses, /accessories, and /consumables returned 403 Forbidden.

The same account received 200 OK from /users/<target-user-id> and the response included assigned inventory data that should have been protected by the corresponding inventory module permissions.

Negative Controls

Denied direct module responses did not include the test inventory strings. The same data was only disclosed through the user detail and user print views.

Impact

Organizations may use separate permissions to allow HR/helpdesk-style users to view people records without exposing license, accessory, or consumable inventories and cost/order metadata. This issue bypasses those module-specific permissions and leaks assigned inventory information through the user view.

Patches

Patched in 374f426f0c

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:57:40Z",
    "nvd_published_at": "2026-07-10T20:16:46Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nAn authenticated user with only `users.view` can open another user\u0027s detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license names, purchase order/order values, accessory and consumable names, assignment notes, and purchase costs.\n\n### Attacker Model\n\nAuthenticated user with only:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\"users.view\":\"1\"}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe attacker does not have:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\n  \"licenses.view\": \"1\",\n  \"accessories.view\": \"1\",\n  \"consumables.view\": \"1\",\n  \"assets.view\": \"1\"\n}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n### Affected Component\n\n-   `app/Http/Controllers/Users/UsersController.php`\n\n-   `resources/views/users/view.blade.php`\n\n-   `resources/views/users/print.blade.php`\n\n-   Endpoints:\n\n    -   `GET /users/{user}`\n\n    -   `GET /users/{user}/print`\n\n### Root Cause\n\n`UsersController::show()` authorizes only viewing the user, then loads inventory relationships:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ php\n$this-\u003eauthorize(\u0027view\u0027, $user);\n\n$user = User::with([\n    \u0027consumables\u0027,\n    \u0027accessories\u0027,\n    \u0027licenses\u0027,\n    \u0027userloc\u0027,\n    \u0027groups\u0027,\n])\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n`resources/views/users/view.blade.php` renders those relationships without checking the corresponding module permissions. The license table renders name, purchase cost, purchase order, and order number. The accessory and consumable tables render item names, notes, and unit costs.\n\n`UsersController::printInventory()` similarly authorizes only `view` on `User::class` and the target user, then renders `resources/views/users/print.blade.php`, which outputs assigned inventory names.\n\n### Proof of Concept\n\n1.  Create a user with only `users.view`.\n\n2.  Create a target user with assigned license/accessory/consumable records containing recognizable test values.\n\n3.  Log in as the `users.view`-only user.\n\n4.  Confirm direct module access is denied:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /licenses\nGET /accessories\nGET /consumables\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved for each:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 403 Forbidden\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n1.  Request the target user\u0027s page:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /users/\u003ctarget-user-id\u003e HTTP/1.1\nHost: \u003csnipe-it-host\u003e\nCookie: snipeit_session=\u003cattacker-session\u003e\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 200 OK\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe response contained assigned inventory data from modules the attacker could not directly access, including license name, purchase order/order values, accessory name/note/cost, and consumable name/note/cost.\n\n1.  Request the print view:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /users/\u003ctarget-user-id\u003e/print HTTP/1.1\nHost: \u003csnipe-it-host\u003e\nCookie: snipeit_session=\u003cattacker-session\u003e\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 200 OK\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe response contained assigned inventory names.\n\n### Evidence\n\nThe `users.view`-only test account was confirmed to lack direct inventory permissions:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\n  \"has_users_view\": true,\n  \"has_licenses_view\": false,\n  \"has_accessories_view\": false,\n  \"has_consumables_view\": false,\n  \"has_assets_view\": false\n}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDirect access to `/licenses`, `/accessories`, and `/consumables` returned `403 Forbidden`.\n\nThe same account received `200 OK` from `/users/\u003ctarget-user-id\u003e` and the response included assigned inventory data that should have been protected by the corresponding inventory module permissions.\n\n### Negative Controls\n\nDenied direct module responses did not include the test inventory strings. The same data was only disclosed through the user detail and user print views.\n\n### Impact\n\nOrganizations may use separate permissions to allow HR/helpdesk-style users to view people records without exposing license, accessory, or consumable inventories and cost/order metadata. This issue bypasses those module-specific permissions and leaks assigned inventory information through the user view.\n\n\n### Patches\nPatched in 374f426f0c",
  "id": "GHSA-fc33-6w3q-538h",
  "modified": "2026-08-28T17:57:40Z",
  "published": "2026-08-28T17:57:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55462"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grokability/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Snipe-IT has an authorization bypass on print inventory page"
}

CVE-2026-55462 (GCVE-0-2026-55462)

Vulnerability from cvelistv5 – Published: 2026-07-10 19:35 – Updated: 2026-07-13 15:01

Title

Snipe-IT: Authorization bypass on print inventory page

Summary

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 15:01 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/grokability/snipe-it/security/…	x_refsource_CONFIRM
https://github.com/grokability/snipe-it/commit/37…	x_refsource_MISC
https://github.com/grokability/snipe-it/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grokability	snipe-it	Affected: < 8.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55462",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T15:01:13.489641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T15:01:17.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "snipe-it",
          "vendor": "grokability",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T19:35:05.107Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h"
        },
        {
          "name": "https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5"
        },
        {
          "name": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-fc33-6w3q-538h",
        "discovery": "UNKNOWN"
      },
      "title": "Snipe-IT: Authorization bypass on print inventory page"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55462",
    "datePublished": "2026-07-10T19:35:05.107Z",
    "dateReserved": "2026-06-16T22:10:37.608Z",
    "dateUpdated": "2026-07-13T15:01:17.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-FC33-6W3Q-538H

Impact

Attacker Model

Affected Component

Root Cause

Negative Controls

Impact

Patches

CVE-2026-55462 (GCVE-0-2026-55462)

Tags

Sightings

Nomenclature