CVE-2026-50550

Published: Aug 19, 2026Modified: Sep 30, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Exploitability: 2.1 / Impact: 4.2

Source: NVD

Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

Affected (1)

Products: Snipeitapp: Snipe It

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snipeitapp Snipe It	version < 8.5.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://github.com/grokability/snipe-it/commit/046ef82c6501be14df597f0bf5d0de2566c7d6bc

Source: security-advisories@github.com

Patch

https://github.com/grokability/snipe-it/releases/tag/v8.5.0

Source: security-advisories@github.com

Release NotesPatch

https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.