high · 7.1CVE-2026-55460Aug 28, 2026

CVE-2026-55460: Snipe-IT Authorization Bypass on Bulk User Delete

Rohit Hatagale
AI Security Researcher, SecureLayer7

A logged-in Snipe-IT user with only edit permissions can silently delete other users by bypassing the permission gate that protects the bulk-delete endpoint.

Packagesnipe/snipe-it
Ecosystemcomposer
Affected<= 8.6.1
Fixed in8.6.2
CVE-2026-55460: Snipe-IT Authorization Bypass on Bulk User Delete

The problem

In Snipe-IT <= 8.6.1, the bulk-save controller method BulkUsersController::destroy() gates access with $this->authorize('update', User::class) instead of delete. This means any authenticated user holding users.view and users.edit can reach the destructive code path.

When the POST body includes delete_user=1, the method calls $user->delete() and soft-deletes the target, with no delete-permission check at all. Admins are shielded by a separate guard, but any non-admin account is a valid target.

Proof of concept

A working proof-of-concept for CVE-2026-55460 in snipe/snipe-it, with the exact payload below.

http
POST /users/bulksave HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Content-Type: application/x-www-form-urlencoded

_token=<csrf-token>&ids[]=<target-user-id>&delete_user=1&status_id=<valid-status-id>

The root cause is a mismatched authorization verb. The UI and the confirmation route both check the delete policy, but destroy() checked only update, so a user with edit-but-not-delete permission sailed past the gate. Patch commit 374f426f0c fixes the single line in destroy(), replacing authorize('update', ...) with authorize('delete', ...), closing the gap between what the UI promises and what the server enforces.

CWE-863 (Incorrect Authorization) applies exactly here: the wrong policy action was evaluated at the decision point.

The fix

Upgrade to Snipe-IT 8.6.2 or later. As a short-term workaround, revoke users.edit from any account that should not also have users.delete, since the flaw is exploitable by any holder of that permission. Monitor server logs for unexpected POST requests to /users/bulksave containing delete_user=1.

Reporter not attributed.

References: [1][2][3][4][5]

Related research