Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a privilege escalation issue in Snipe-IT's user creation functionality. The store method within the app/Http/Controllers/Users/UsersController.php file incorrectly authorized group assignments. The original code checked if a user had the canEditAuthFields permission before allowing them to assign a group to a newly created user. This permission was not restrictive enough, allowing a user with basic user creation privileges (like an HR manager) to create a new user and assign them to a group with full admin permissions.
The patch aea3877718 addresses this by replacing the can('canEditAuthFields', $user) check with a much stricter isSuperUser() check. This ensures that only superusers, who already have the highest level of privileges, can assign groups during user creation, effectively closing the privilege escalation pathway.
The identified vulnerable function is UsersController::store. While the security advisory mentions that both the web and API UsersController are affected, the provided commit only includes a patch for the web controller. Based on the available evidence, UsersController::store is the confirmed vulnerable function.
UsersController::storeapp/Http/Controllers/Users/UsersController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 8.6.0 | 8.6.0 |