CVE-2026-48507: Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Synopsis

An authorization-bypass vulnerability in Snipe-IT, the open-source IT asset and license management system, allows any user holding the low-privilege `users.edit` permission to flip two sensitive account-control flags on other user accounts: `activated` (controls whether a user can log in) and `ldap_import` (controls whether a user can reset their password). The attack is reachable over the network with no elevated privileges beyond that single granular permission, and no victim interaction is required. Successful exploitation lets an attacker disable every admin account in the instance, achieving a complete authentication lockout. HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Snipe-IT web interface over the network; the vulnerable bulk-edit endpoint is exposed via HTTP.

• AuthenticationRequired

  The attacker must hold a valid account with at least the low-privilege `users.edit` granular permission; any such account is sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker submits the bulk-edit request directly without any social-engineering step.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: no race conditions or special environmental factors need to align for the attack to succeed.

Blast Radius

• Sets the `activated` flag to false on all admin accounts, preventing every admin from logging into the instance.
• Sets the `ldap_import` flag on admin accounts, blocking LDAP-authenticated admins from requesting a password reset, removing the self-service recovery path.
• Results in a full administrative lockout of the Snipe-IT instance, halting asset and license management operations until an out-of-band database intervention restores at least one admin account.