CVE-2026-48492
Snipe-IT's selectlist visibility is too permissive
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Snipe-IT's selectlist visibility is too permissive
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
- Record
CVE-2026-48492- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-42433
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
- Record
EUVD-2026-42433- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f3c5-6cw8-fg57
Snipe-IT's selectlist visibility is too permissive
Impact
The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled.
What an attacker can do with a valid login and zero permissions:
- Enumerate all active user accounts by paginating through the endpoint
- Harvest usernames for credential stuffing or password spray attacks
- Collect employee numbers and full names for social engineering
- Perform indirect email enumeration via the search parameter
- Map user IDs for use in further enumeration against other endpoints
This vulnerability is exploitable only by users who have a working login to the Snipe-IT system.
Patches
https://github.com/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f
- Record
GHSA-f3c5-6cw8-fg57- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
- Record
CVE-2026-48492- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Snipe-IT's selectlist visibility is too permissive
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
- Record
CVE-2026-48492- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-f3c5-6cw8-fg57
Snipe-IT's selectlist visibility is too permissive
Impact
The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled.
What an attacker can do with a valid login and zero permissions:
- Enumerate all active user accounts by paginating through the endpoint
- Harvest usernames for credential stuffing or password spray attacks
- Collect employee numbers and full names for social engineering
- Perform indirect email enumeration via the search parameter
- Map user IDs for use in further enumeration against other endpoints
This vulnerability is exploitable only by users who have a working login to the Snipe-IT system.
Patches
https://github.com/grokability/snipe-it/commit/4f943d4a7ab8e53f3d9e32770602d1118bab005f
- Record
GHSA-f3c5-6cw8-fg57- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snipe/snipe-itPackagist |
before 8.5.1 | 8.5.1 |
snipe/snipe-itPackagist |
before 8.5.1, plus listed versions 3.2.0v0.1.0v0.1.1v0.1.2v0.2.0 Show 45 moreShow lessv0.3.0-alphav0.3.10-alphav0.3.11-alphav0.3.7-alphav0.3.8-alphav0.3.9-alphav1.0v1.1v1.2.0v1.2.1v1.2.10v1.2.11v1.2.2v1.2.3v1.2.3-betav1.2.4v1.2.4-betav1.2.5v1.2.6v1.2.6-betav1.2.6.1v1.2.7v1.2.7-betav1.2.8v1.2.9v2.0v2.0-RC-1v2.0-betav2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.2v3.0v3.0-alphav3.0-alpha2v3.0-beta.1v3.0-beta.2v3.0-beta.3v3.0.0-betav3.1.0 |
8.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48492 is a medium vulnerability (CVSS 4.9) in Grokability Snipe-it, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in snipe/snipe-it 8.5.1.
References
github.com/grokability/snipe-it/security/advisories/GHSA-f3c5-6cw8-fg57
nvd.nist.gov/vuln/detail/CVE-2026-48492
Left out here: 226 versions. The JSON record has them.