Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-19T19:17:18.380Z",
  "pubdate": "2026-08-19T19:17:18.380Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Snipe-IT prior to version 8.5.0 within the API user management functionality. The flaw specifically resides in the postTwoFactorReset() method located in app/Http/Controllers/Api/UsersController.php. This security deficiency allows a low-privilege user who possesses general user editing capabilities to reset the two-factor authentication configuration of a superadmin account.\nThe vulnerability directly impacts the confidentiality and integrity of privileged administrative accounts within deployments of Snipe-IT. Successful exploitation allows an attacker with standard user-edit privileges to invalidate and clear critical security controls, specifically the two_factor_secret and two_factor_enrolled database fields, effectively disabling multi-factor authentication for higher-privileged users.\nThe risk implication is severe, as compromising a superadmin account via bypassed security controls can lead to complete administrative takeover of the IT asset management system. Exploitation requires authenticated access with permissions to edit standard users, but bypasses the intended security barrier that restricts modification of sensitive authentication fields. Remediation requires upgrading the Snipe-IT installation to version 8.5.0 or later, where the proper validation logic has been enforced.",
  "technicalDetails": "The vulnerability stems from an insufficient authorization check within the API controller handling user account modifications. Specifically, the vulnerable component is identified as app/Http/Controllers/Api/UsersController.php, wherein the postTwoFactorReset() function is implemented to process requests aimed at clearing two-factor authentication parameters.\nThe root cause of the issue is a failure in enforcing the canEditAuthFields authorization policy. While the endpoint correctly verifies that the attacking user possesses generic update access over other user profiles, it neglects to validate whether the actor holds the specific privilege required to manipulate sensitive authentication attributes. Consequently, when an unauthorized user issues a request to the postTwoFactorReset endpoint, the application proceeds to execute database operations that clear the target user's two_factor_secret and two_factor_enrolled attributes.\nThe attack flow proceeds as follows: an authenticated user with permissions to edit standard user accounts targets a superadmin account within the Snipe-IT instance. The attacker formulates an API request directed at the postTwoFactorReset() endpoint associated with the superadmin user ID. Because the endpoint improperly validates only general update permissions and omits the critical canEditAuthFields check, the backend accepts the request without restriction. The application subsequently processes the logic to nullify the two-factor authentication secrets tied to the superadmin profile.\nAs a result of this payload behavior, the superadmin's multi-factor authentication protection is silently dismantled. Post-exploitation impact includes the potential for the attacker to leverage subsequent authentication vectors or compromised credentials without the friction of 2-factor verification, ultimately leading to horizontal or vertical privilege escalation and full administrative compromise of the asset management platform. Affected versions include all Snipe-IT deployments prior to version 8.5.0."
}