### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new user with full admin privileges. The `users.create permission` may commonly be delegated to HR staff, department leads, or similar roles. ### Patches Patched in [aea3877718](https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb)
Update snipe/snipe-it to 8.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSnipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation affects snipe/snipe-it (composer). Severity is medium. ### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new user with full admin privileges. The `users.create permission` may commonly be delegated to HR staff, department leads, or similar roles. ### Patches Patched in [aea3877718](https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb)
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| snipe/snipe-itcomposer |
### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new user with full admin privileges. The `users.create permission` may commonly be delegated to HR staff, department leads, or similar roles. ### Patches Patched in [aea3877718](https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb)
Update snipe/snipe-it to 8.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSnipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation affects snipe/snipe-it (composer). Severity is medium. ### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new user with full admin privileges. The `users.create permission` may commonly be delegated to HR staff, department leads, or similar roles. ### Patches Patched in [aea3877718](https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb)
AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| snipe/snipe-itcomposer |
| <8.6.0 |
| 8.6.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| <8.6.0 |
| 8.6.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard