Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T19:17:17.923Z",
  "pubdate": "2026-08-19T19:17:17.923Z",
  "executiveSummary": "An improper authorization and privilege escalation vulnerability exists in Snipe-IT prior to version 8.6.1, allowing an authenticated user with import permissions to execute an account takeover attack against non-admin users.\nThe vulnerability stems from improper validation and sanitization during the CSV update mode processing within the application's import handling components.\nAn attacker possessing the base import permission can exploit this flaw by supplying a crafted CSV file that overwrites the email address associated with a targeted non-admin user account.\nFollowing the successful overwrite of the target user's email address, the attacker can leverage the built-in password reset functionality to request a reset token, ultimately achieving full account compromise and taking over the target account.\nThe risk implications are significant as unauthorized users can escalate their privileges or hijack other standard user accounts within the asset management system.\nSuccessful exploitation requires the attacker to possess the specific import permission and utilize the CSV update mode feature.\nThis security defect is officially addressed and resolved in Snipe-IT version 8.6.1 through proper permission enforcement and data sanitization.",
  "technicalDetails": "The vulnerability is rooted in a discrepancy between authorization checks and data reconstruction logic within the CSV import pipeline of Snipe-IT.\nSpecifically, the component app/Importer/UserImporter.php applies the canEditAuthFields gate designed to protect sensitive authentication parameters by unsetting critical attributes such as username, email, password, and activated status on the model.\nHowever, the underlying method sanitizeItemForUpdating() located in app/Importer/ItemImporter.php bypasses these security controls by rebuilding the update array directly from the raw CSV row contained within the $this->item property, thereby restoring the unauthorized values.\nFurthermore, the import execution path handled by app/Http/Controllers/ImportController.php verifies that the user possesses general import privileges but fails to enforce the required users.edit permission, creating an authorization bypass.\nThe affected versions include all Snipe-IT installations prior to version 8.6.1.\nThe exploitation flow proceeds step-by-step as follows: First, an attacker with basic import capabilities prepares a malicious CSV file containing targeted user records with modified email addresses mapped to accounts they wish to compromise.\nSecond, the attacker initiates the CSV update mode via the ImportController.php import path.\nThird, while app/Importer/UserImporter.php attempts to strip sensitive fields using the canEditAuthFields gate, app/Importer/ItemImporter.php overrides this protection by reconstructing the update dataset from the raw input payload.\nFourth, the database is updated with the attacker-controlled email address for the specified non-admin user profile.\nFinally, the attacker invokes the application's password reset mechanism, directing the recovery procedures to the newly overwritten email address, allowing them to complete the password reset workflow and fully compromise the target account."
}