Snipe‑IT’s UsersController::update() improperly processes an update request that lacks a permission field, allowing the action to overwrite a target user’s permission set with a sparse result. This flaw permits an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions, effectively downgrading their role and weakening the overall role integrity within the asset‑management system.

The vulnerability affects the Snipe‑IT asset‑and‑license‑management application from grokability. All installations running a version earlier than 8.6.0 are vulnerable; the issue is fully addressed in releases starting with v8.6.0.

With a CVSS score of 7, the flaw is considered medium severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with users.edit or administrative update request to the UsersController. Once a user operates the vulnerable endpoint, they can reduce or eliminate another user’s rights, potentially disrupting administrative control or enabling further malicious activity. The likely attack vector is via the UsersController::update API endpoint that accepts user‑role modification requests.