CVE-2026-38533

Published: Apr 14, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

Affected (1)

Products: Snipeitapp: Snipe It

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snipeitapp Snipe It	Version 8.4.0

Related CWEs

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38533

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://snipeitapp.com/

Source: cve@mitre.org

Product

https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38533/poc.md

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.