An improper authorization flaw allows an attacker who is already logged in and holds users.edit permission to send a crafted PUT request to the /api/v1/users/{id} endpoint and alter sensitive authentication and account‑state fields for another non‑admin user. If exploited, this can let the attacker change another user’s password, unlock or lock the account, or otherwise manipulate authentication details, effectively permitting account takeover or denial of service against that user.

The vulnerability is present in Snipe‑IT Version 8.4.0, the open‑source asset management web application. Only users who are not administrators but possess the users.edit permission can be targeted, while admin accounts are not affected by this specific flaw.

The CVSS score is 6.5, and the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attacker must first authenticate to the API with a valid credential and possess the users.edit permission, indicating that privileged access is required. Once obtained, the misuse of that permission allows modification of another user’s sensitive fields, raising the potential for privilege escalation, data compromise, and service disruption. The lack of an official patch or workaround means the risk remains until an updated version is deployed or permissions are tightened.