https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:18:42.131745+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-332308 EUVD-2026-332308 2026-10-04T08:18:42.185996+00:00 EUVD-2026-332308 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44832 fkie_cve-2026-44832 2026-10-04T08:18:42.186034+00:00

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.

 https://cve.radiocsirt.org/vuln/ghsa-hq28-crg7-95pr GHSA-hq28-crg7-95pr — Snipe-IT has Privilege Escalation via API Permissions Assignment 2026-10-04T08:18:42.186068+00:00

Affected: Packagist: snipe/snipe-it

### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users.

### Patches Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1

### Workarounds None.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1377 WID-SEC-W-2026-1377 — Snipe-IT: Mehrere Schwachstellen 2026-10-04T08:18:42.186098+00:00

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, Administratorrechte zu erlangen oder beliebigen Code auszuführen.