CVE-2026-50550

Published: Aug 19, 2026Modified: Aug 19, 2026

5.8

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Exploitability: 1.5 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://github.com/grokability/snipe-it/commit/046ef82c6501be14df597f0bf5d0de2566c7d6bc

Source: security-advisories@github.com

https://github.com/grokability/snipe-it/releases/tag/v8.5.0

Source: security-advisories@github.com

https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm

Source: security-advisories@github.com

Timeline

No history available yet.