Snipe-IT, an IT asset/license management system, contains a flaw in its user‑creation workflow. When an authenticated user with the users.create permission submits a new account, the controller’s store() function removes only the superuser right but does not strip the admin permission. As a result, the newly created user acquires administrative privileges. This allows an attacker to obtain full control over the platform, enabling them to view, modify or delete assets, licenses, or configuration data. The weakness is identified as CWE‑862.

All installations of Snipe‑IT owned by the grokability vendor that are running a version earlier than 8.6.0. The vulnerability applies specifically to the root application code located in app/Http/Controllers/Users/UsersController.php, and thus affects the entire user‑account management subsystem of the system.

The CVSS score for this issue is 4.9, indicating moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the available data. The vulnerability is not listed in the CISA KEV catalog. The attack can be carried out by any user who is authenticated to the system and possesses the users.create permission, which is normally granted to roles such as asset managers or inventory handlers. Therefore, if such an authenticated role is compromised or misused, the attacker can create an admin user account in the web interface. The exploitation does not require a network‑level attack; it is exercised through normal application interaction. As a result, the risk is moderate to high for organizations where users.create permissions are delegated to non‑trusted personnel.