Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 8.6.0 | 8.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the app/Http/Controllers/Users/BulkUsersController.php file, specifically within the update and merge functions. Both functions performed bulk operations on user objects without properly authorizing the action for each individual user in the set.
The update function allowed any user with the users.edit permission to modify any attribute on any user via the bulk edit feature. This included sensitive attributes like activated (which controls if a user can log in) and ldap_import (which controls if a user can use password resets). A malicious user could leverage this to lock out all administrators from the application.
The merge function had a similar flaw, where it did not check if the acting user had the permission to merge the target user.
The patch addresses these issues by removing the mass-assignment of sensitive fields in the update function and instead looping through each user to check for the appropriate canEditAuthFields permission before applying changes. A similar check was added to the merge function. Any runtime profile during exploitation would show calls to App\Http\Controllers\Users\BulkUsersController::update or App\Http\Controllers\Users\BulkUsersController::merge.
App\Http\Controllers\Users\BulkUsersController::updateapp/Http/Controllers/Users/BulkUsersController.php
App\Http\Controllers\Users\BulkUsersController::mergeapp/Http/Controllers/Users/BulkUsersController.php