Snipe‑IT, an IT asset management system, contains an authorization bypass that allows authenticated non‑admin accounts that possess users.view and users.edit permissions to submit a POST request to /users/bulksave with the delete_user flag set to 1. The BulkUsersController::destroy action authorizes only the update permission, ignoring the missing users.delete privilege, which enables the attacker to soft‑delete arbitrary non‑admin user accounts. This flaw effectively grants privilege escalation, removing other users from the system and disrupting asset tracking. The vulnerability is identified as CWE‑863.

Snipe‑IT (grokability) versions prior to 8.6.2 are affected. Version 8.6.2 and later address the authorization check and must be used to mitigate the issue.

The CVSS score of 7.1 signifies a medium‑to‑high risk level. The EPSS score of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with users.view and users.edit rights; no administrative privileges are necessary. If internal users can obtain those permissions, they can delete other non‑admin accounts without oversight.