An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Snipeitapp |
|
No data.
No data.
References
History
Wed, 15 Apr 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Snipeitapp
Snipeitapp snipe-it |
|
| Vendors & Products |
Snipeitapp
Snipeitapp snipe-it |
Tue, 14 Apr 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Authorization Enables Modification of Authentication Fields in Snipe‑IT | |
| Weaknesses | CWE-285 |
Tue, 14 Apr 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-04-14T00:00:00.000Z
Updated: 2026-04-14T15:21:08.509Z
Reserved: 2026-04-06T00:00:00.000Z
Link: CVE-2026-38533
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-14T16:16:43.963
Modified: 2026-04-14T16:16:43.963
Link: CVE-2026-38533
Redhat
No data.