Technical impact
Snipe‑IT’s Kits API fails to perform a required object‑level authorization check. When an authenticated user sends a POST request to /api/v1/kits/{kit_id}/licenses, the system verifies that the caller has permission to edit the kit but does not verify that the caller can access the referenced license. Consequently, a user with only kit‑editing privileges can bind a license they would normally be barred from accessing or managing. The flaw is catalogued as CWE‑639.
Affected Systems
All installations of grokability:snipe‑it earlier than version 8.6.2 are affected. The issue was resolved in release 8.6.2 and remains fixed in all subsequent versions.
Risk and Exploitability
The likely attack vector is a network‑based API call that an authenticated user can execute from the web interface or an API client; this inference comes from the description’s mention of a POST request. Exploitation requires only kit‑edit permissions and no higher privilege. The CVSS score of 5.3 denotes moderate severity, while the EPSS score, being below 1%, indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Although the exploitation likelihood is low, the impact on environments where kit‑edit rights are granted means that mitigation is essential.
Github GHSA