CVE-2026-50550CWE-863broken-access-control

CVE-2026-50550

Medium · published August 19, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-19T23:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.5.08.5.0
References (3)
https://github.com/grokability/snipe-it/commit/046ef82c6501be14df597f0bf5d0de2566c7d6bc · [email protected]https://github.com/grokability/snipe-it/releases/tag/v8.5.0 · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm · [email protected]
EPSS history
Timeline
  • 19 AUG 18:15Z
    Snipe-IT: 2FA reset privilege bypass
    cvelistv5