This vulnerability in Snipe-IT v8.4.0 allows authenticated users who have the users.edit permission to bypass proper authorization controls on the /api/v1/users/{id} endpoint. By crafting PUT requests, these users can alter sensitive fields related to authentication and account state for other non-admin users, potentially impacting account integrity and security. No patch or official remediation guidance is currently available, and the vulnerability has been publicly disclosed without a CVSS score.

The vulnerability enables users with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users. This could lead to unauthorized changes in user account status or authentication parameters, potentially undermining account security and trust within the affected system. There is no evidence of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the users.edit permission to trusted administrators only and monitor for unusual account modifications.