CVE-2026-85617

Snipe-IT, a self-hosted open-source IT asset management platform, contains an authorization bypass (CWE-639) in its bulk user delete functionality in all versions prior to 8.6.3. An authenticated user with restricted, scope-limited permissions can submit a bulk delete request that includes user IDs outside their authorized scope, and the application soft-deletes them without validating that the target users belong to the attacker's permitted scope. This lets a low-privileged attacker modify or disable (soft-delete) accounts they should not be able to access, bypassing instance-level restrictions and potentially disrupting administrator or other users' accounts (CVSS 4.0: 8.7 High, network vector, low privileges, no user interaction). All Snipe-IT deployments running a version before 8.6.3 that use restricted user roles are affected. There is currently no public proof of concept, the flaw is not in the CISA KEV catalog, and EPSS is low (0.3%), indicating no known exploitation to date.

What to do: Upgrade to Snipe-IT 8.6.3 or later, which enforces scope checks in bulk delete. Until patched, restrict bulk-delete capability to fully privileged roles and review audit logs for bulk user delete actions performed by restricted users; check for and restore any accounts soft-deleted or modified outside their assigned company/scope.