The vulnerability in Snipe-IT allows a user with edit rights over other accounts to reset the two-factor authentication of a superadmin by using the postTwoFactorReset API endpoint. The endpoint performs an update authorization check but fails to enforce the canEditAuthFields permission before clearing the two_factor_secret and two_factor_enrolled fields, effectively disabling the superadmin’s second factor. This results in a privilege escalation flaw whereby an attacker who can edit users can later log in to the superadmin account without a second factor, gaining unrestricted control of the system. The weakness is identified as CWE-863. The CVSS score of 5.8 indicates moderate severity.

All Snipe‑IT releases prior to version 8.5.0 are affected. The product is maintained by grokability and the fix is included in the 8.5.0 release.

The CVSS score of 5.8 reflects a moderate severity risk, meaning disabling a superadmin’s 2FA can have serious consequences. Because the EPSS score is not available, the exact exploitation probability cannot be quantified, yet the vulnerability is not catalogued in the CISA KEV catalog, indicating no widespread exploitation is known. The most likely vector is an authenticated HTTP request to the API endpoint, which an insider or a compromised account can easily perform. The risk can be mitigated by applying the vendor’s patch or hardening the permission model.