Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 8.5.0 | 8.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, described as a '2FA reset privilege bypass', allows a user with editing permissions to reset a superadmin's 2FA. The patch was released in version 8.5.0. By comparing the git tags for version 8.4.1 (the last vulnerable version) and 8.5.0, I identified a commit with the message 'Added gates for 2FA reset API endpoint'. This commit modifies the postTwoFactorReset function in app/Http/Controllers/Api/UsersController.php. The change replaces a general 'update' authorization check with a more specific check, canEditAuthFields. This confirms that the postTwoFactorReset function was the source of the vulnerability, as it lacked a sufficiently strict permission check, allowing for privilege escalation.
App\Http\Controllers\Api\UsersController::postTwoFactorResetapp/Http/Controllers/Api/UsersController.php