This vulnerability allows an authenticated user who has only the users.edit permission to elevate their own privileges to full administrator. By issuing a PATCH request to /api/v1/users/{id} with the payload permissions[admin]=1, the API does not properly filter the superuser key, meaning the admin flag can be set by any user who can update a user record. The weakness is identified as CWE-281 (Improper Access Control) and CWE-863 (Information Exposure through Authorization Checks).

Snipe-IT, version prior to 8.4.1, owned by grokability. The affected system is a web-based asset and license management application in which user accounts can be modified via its REST API. The vulnerability is present in all releases before 8.4.1. No other vendors or products are listed.

The CVSS score of 7.1 indicates medium to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote application-based, requiring only API access and the users.edit permission. An attacker who can execute a PATCH request against the API can gain administrator rights, potentially compromising all aspects of the system, including asset inventory, licensing data, and internal controls.