CVE-2026-49976
MediumCVSS 6.5Summary
Snipe-IT prior to 8.6.1 allows a user with import permission to overwrite a non-admin user's email via CSV update mode and then request a password reset to take over the account. UserImporter strips unauthorized fields, but ItemImporter restores them from the raw CSV row, and the import path does not require users.edit.
Risk Assessment
The risk includes account takeover through import manipulation, potentially leading to unauthorized data access.
Recommendation
Update to version 8.6.1 or later and require users.edit permission for import operations that modify authentication data.
Original NVD description (English source)
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.