A vulnerability in Snipe-IT versions before 8.6.0 lets a non-administrator who has the users.edit permission modify the activated and ldap_import flags for all users in bulk. By setting activated to false for every account, the attacker can prevent all administrators from logging in, effectively halting the asset management system. This privilege escalation, which falls under CWE-863, leads to loss of administrative control and availability of the system.

Snipe-IT, an open-source IT asset and license management solution, is affected. All releases prior to 8.6.0 are vulnerable when a user with users.edit permission can perform bulk edits on the activated or ldap_import fields. The flaw applies to any deployment of these versions where non-admin accounts are granted users.edit access.

The CVSS score of 7.1 indicates high severity. EPSS is not published, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with the users.edit permission to exploit the flaw; the most likely attack vector is authenticated remote manipulation through the web interface. The attacker requires only that permission set on a non-admin account, which may be granted in many environments, making the vulnerability practically exploitable in typical setups.