Snipe-IT Privilege Escalation Vulnerability in User Permissions API

A privilege escalation vulnerability has been identified in Snipe-IT versions prior to 8.4.1. An authenticated user with 'users.edit' permission can elevate their privileges to admin by sending a PATCH request to the user permissions API endpoint. The API improperly handles the permissions array by only removing the 'superuser' key, allowing the 'admin' key and others to be modified by any user with permission to edit users.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, granting a user admin rights.

Remediation

Users can upgrade to Snipe-IT version 8.4.1 or later to address this vulnerability.