CVE-2026-48492
published 2026-07-08CVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.39%
31.6th percentile
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grokability | snipe-it | < 8.5.1 | 8.5.1 |
| snipe | snipe-it | >= 0 < 8.5.1 | 8.5.1 |
| snipeitapp | snipe-it | < 8.6.0 | 8.6.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.04.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
grokability Snipe-IT up to 8.5.0 API Endpoint improper authorization
vuldb·2026-07-09·CVSS 4.9
CVE-2026-48492 [MEDIUM] grokability Snipe-IT up to 8.5.0 API Endpoint improper authorization
A vulnerability was found in grokability Snipe-IT up to 8.5.0 and classified as problematic. This affects an unknown part of the component API Endpoint. Executing a manipulation can lead to improper authorization.
This vulnerability appears as CVE-2026-48492. The attack may be performed from remote. There is no available exploit.
GHSA
Snipe-IT's selectlist visibility is too permissive
ghsa·2026-06-23
CVE-2026-48492 [MEDIUM] CWE-862 Snipe-IT's selectlist visibility is too permissive
Snipe-IT's selectlist visibility is too permissive
### Impact
The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled.
### What an attacker can do with a valid login and zero permissions:
- Enumerate all active user accounts by paginating through the endpoint
- Harvest usernames for credential stuffing or password spray attacks
- Collect employee numbers and full names for
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-08
Published