Summary
Snipe-IT contains an authorization enforcement flaw in user creation that allows an authenticated user with permission to create users to grant a newly created account administrative privileges. The risk arises when the application removes only superuser permission while accepting the admin permission during account creation.
Affected context
The vulnerability affects Snipe-IT deployments using the vulnerable user-creation workflow in versions prior to 8.6.0. It becomes relevant when an authenticated account has the users.create permission and can submit user attributes that include administrative permissions. The issue occurs in the server-side handling of account creation, where authorization values are incompletely filtered.
Exploit preconditions
- Attack surface: Authenticated user-creation functionality
- Required access: An account with the
users.createpermission - Trigger point: Server-side processing of a new user account
- Why exploitation is possible: The creation logic strips superuser permission but does not consistently reject the admin permission, allowing an unauthorized privilege assignment
Why this happens
The underlying bug is incomplete server-side authorization enforcement during user creation. The application applies a narrow permission filter that removes one highly privileged role but leaves another administrative role accepted from the request. This behavior maps to CWE-862: Missing Authorization, because the system fails to independently verify whether the requester is authorized to grant administrative privileges.
Potential impact
- A newly created account may obtain administrative privileges
- An attacker could access protected asset, user, or license management functions
- Administrative actions could lead to data modification, disclosure, or deletion
- The affected tenant or organization could experience broader account and configuration compromise
General mitigation guidance
Mitigation generally focuses on enforcing authorization independently of client-supplied permission values.
Common defensive patterns include:
- Applying an explicit server-side allowlist for permissions that each requester may grant
- Rejecting administrative role assignments unless the requester has the corresponding authority
- Treating all submitted privilege fields as untrusted input
- Centralizing authorization checks so every account-creation path uses the same policy
- Applying least privilege to user-management roles and administrative accounts
- Adding regression tests for prohibited privilege combinations and permission-boundary cases
These controls help ensure that removing one privileged role cannot leave another unauthorized administrative role assignable.
How teams detect issues like this
Organizations can identify similar authorization flaws through:
- Static analysis and code review of controller logic that filters or transforms role and permission fields
- Tests that verify users cannot grant privileges beyond their own authority
- Review signals such as client-controlled administrative attributes and deny-only permission filtering
- Audit-log monitoring for newly created accounts receiving administrative roles
- Policy enforcement requiring centralized authorization checks for user and role management
Automated code review tools may help identify missing authorization checks, but behavioral tests and permission-boundary reviews remain important.
