CVE-2026-50550: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through…

PriorityP434medium5.8CVSS 3.1

AVAACLPRLUIRSUCLIHAN

EPSS

0.18%

7.5th percentile

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
grokability	snipe-it	< 8.5.0	8.5.0
snipe	snipe-it	>= 0 < 8.5.0	8.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.