Description

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T12:17:25.410Z",
  "pubdate": "2026-09-04T12:17:25.410Z",
  "executiveSummary": "This vulnerability is an authorization bypass flaw identified within the bulk delete functionality of Snipe-IT versions prior to 8.6.3. The vulnerability permits authenticated, restricted users to perform unauthorized soft-delete operations on user accounts that exist outside of their explicitly defined management scope.\nThe core issue stems from insufficient server-side validation of user-supplied identifiers during bulk processing requests. By manipulating the request payload to include arbitrary user IDs, an attacker can circumvent instance-level access controls and authorization checks. This enables non-administrative or scoped users to disable or effectively remove accounts they are not privileged to manage.\nThe risk implication is significant, as it allows for unauthorized manipulation of the asset management system's user directory. An attacker with minimal privileges can cause service disruption by disabling critical accounts or compromising organizational data integrity through unauthorized deletions. Exploitation requires an active, authenticated session with sufficient permissions to access the bulk delete interface. No complex environmental prerequisites are necessary, as the vulnerability resides within the application's core request handling logic, making it a critical concern for multi-user deployments relying on granular access controls.",
  "technicalDetails": "The vulnerability resides in the backend request handling logic responsible for bulk user management within Snipe-IT. Specifically, the bulk delete controller fails to perform adequate authorization verification against each individual identifier (ID) included in the bulk deletion payload. When a user initiates a bulk delete action, the application receives a collection of target IDs and processes them through an iterative loop to perform soft-delete operations.\nThe root cause is a failure to implement a robust access control check within the iteration logic of the delete function. Instead of verifying that the requester maintains administrative authority or scope over every individual user ID submitted in the payload, the application assumes that the initial request authorization applies globally to the provided array. This logic flaw creates a classic Insecure Direct Object Reference (IDOR) pattern, where the server performs sensitive state-changing operations based solely on user-supplied input without validating ownership or organizational boundary permissions.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a restricted user who possesses legitimate access to the bulk delete interface for their assigned scope. 2) The attacker intercepts the HTTP request triggered by the bulk delete action using a proxy tool. 3) The attacker modifies the payload (typically a JSON array or form-encoded list of user IDs) by injecting additional IDs that represent accounts belonging to other departments, administrators, or users outside the attacker’s scope. 4) The server receives the modified payload and processes the requests. Because the backend code lacks per-ID validation, it treats all provided IDs as targets for deletion regardless of the requester's actual authorization level.\nThe vulnerable component is the bulk delete execution block, which fails to enforce strict boundary checks. The impact is the successful execution of a soft-delete on unauthorized accounts. In the context of Snipe-IT, a soft-delete does not purge the record from the database but marks it as inactive/archived, effectively disabling the target user's access and visibility within the application. This provides a mechanism for unauthorized actors to perform denial-of-service on specific users or disrupt organizational workflows by selectively crippling user account availability. The vulnerability persists across all versions prior to 8.6.3, necessitating an immediate upgrade to the patched version."
}