{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T23:02:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admin user\u0027s email by uploading a CSV, then trigger a password reset to take over the account.\n\n`UserImporter.php` checks the `canEditAuthFields` gate and tries to strip auth fields from the model:\n\n```php\n// app/Importer/UserImporter.php:107-114\nif (Auth::check() \u0026\u0026 (! Gate::allows(\u0027canEditAuthFields\u0027, $user))) {\n    unset($user-\u003eusername);\n    unset($user-\u003eemail);\n    unset($user-\u003epassword);\n    unset($user-\u003eactivated);\n}\n$user-\u003eupdate($this-\u003esanitizeItemForUpdating($user));\n```\n\nThe `unset()`s operate on the model, but `sanitizeItemForUpdating()` rebuilds its array from `$this-\u003eitem` (the raw CSV row), not from the model:\n\n```php\n// app/Importer/ItemImporter.php:135-149\nprotected function sanitizeItemForStoring($model, $updating = false)\n{\n    $item = collect($this-\u003eitem);                  // CSV data, not model attributes\n    $item = $item-\u003eonly($model-\u003egetFillable());\n    if ($updating) {\n        $item = $item-\u003ereject(fn($v) =\u003e empty($v));\n    }\n    return $item-\u003etoArray();\n}\n```\n\nThe attacker\u0027s CSV values pass through untouched.\n\nFor non-admin attacker vs. non-admin, non-superuser target, the gate returns `true` at `AuthServiceProvider.php:137`, so the `unset()` block never executes. The entire import path checks only `$this-\u003eauthorize(\u0027import\u0027)` (`ImportController.php:196`); no `users.edit` check anywhere. The normal API route `PATCH /api/v1/users/{id}` correctly returns 403 for the same user. \n\nAttacker must have import privileges to exploit this, and that permission must be granted specifically and intentionally by a superadmin.\n\n\n### Patches\nPatched in v8.6.0",
  "id": "GHSA-p68w-rgmg-3c2v",
  "modified": "2026-06-23T23:02:03Z",
  "published": "2026-06-23T23:02:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-p68w-rgmg-3c2v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grokability/snipe-it"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Snipe-IT Vulnerable to User Account Escalation via CSV Import"
}