Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 8.4.1 | 8.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability allows a user with users.edit permission to escalate their privileges to admin. This is because the controllers that handle user updates did not properly sanitize the permissions parameter. Specifically, the code checked if a non-superuser was trying to grant superuser privileges, but it did not check if a non-admin was trying to grant admin privileges. An attacker could send a PATCH request to /api/v1/users/{id} or use the web UI to update a user and include permissions[admin]=1 in the request, thereby elevating their privileges. The patch adds a check to ensure that only superusers or admins can modify the admin permission. The vulnerability existed in both the API controller (Api\UsersController) and the web UI controller (Users\UsersController). The provided patch explicitly fixes the web UI controller, and the vulnerability description explicitly mentions the API controller.
