Snipe-IT, a widely used IT asset and license management system, contains a flaw that allows any user possessing only the users.edit permission to elevate their own privileges through the API. By sending a PATCH request to /api/v1/users/{their_own_id}, the user can grant themselves any permission except the privileged admin or superuser roles, including access to asset viewing and creation, report generation, and import functionality. This escalation enables the user to perform actions that are normally restricted, potentially compromising confidentiality, integrity, and availability of asset data without becoming a full administrator.

The vulnerability affects all installations of Snipe-IT running a version earlier than 8.6.0. It is provided by the vendor grokability under the product name Snipe-IT. No additional sub‑component or operating system versions are specified beyond the version threshold.

The CVSS score of 5.5 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw as any user who has the users.edit permission, which could be a legitimate user or a compromised account. The issue is an internal API interaction, so a network attacker would need to authenticate and possess the users.edit role; the attack does not provide root or admin privileges but grants significant permissions that can be used to undermine system security.