CVE-2026-49976
Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.
How to fix
- snipeitapp snipe-it8.6.1 or later
- snipe/snipe-it8.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snipeitapp snipe-it | v < 8.6.1 | 8.6.1 |
| snipe/snipe-itPackagist | v < 8.6.0 | 8.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.