Technical impact
The vulnerability lies in the GoogleAuthController::handleGoogleCallback method of Snipe-IT, allowing an attacker who can trigger a Google SSO callback to log in as a user whose email matches a Google account without requiring the activated flag. This flaw effectively bypasses authentication controls and permits deactivated users to regain sessions with their original permission levels, including administrative rights. The underlying weakness corresponds to CWE-285, which denotes an authentication bypass or privilege escalation scenario.
Affected Systems
This issue affects all Snipe-IT installations running a version earlier than 8.6.3. Users of the commercial Snipe-IT application, which is distributed by Snipe IT App, are at risk if they have accounts that have been deactivated but whose usernames match enabled Google identities.
Risk and Exploitability
The vulnerability presents a clear remote exploitation path through the Google SSO callback, without needing local access or user interaction beyond the login step. Attackers with valid Google credentials for a target account can exploit deactivated user accounts that retain the same email address, effectively bypassing activation checks and establishing a session with the visitor’s original permissions. Guarding against this requires patching the affected version and ensuring deactivated accounts are isolated from SSO flows.
