Recommended action

Update snipe/snipe-it to 8.5.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Snipe-IT has a 2FA reset privilege bypass affects snipe/snipe-it (composer). Severity is medium. ### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references

Recommended action

Update snipe/snipe-it to 8.5.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Snipe-IT has a 2FA reset privilege bypass affects snipe/snipe-it (composer). Severity is medium. ### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Fixed versions are reported by the source feed; confirm compatibility before updating.

Evidence and references