Snipe-IT versions before 8.4.1 contain a vulnerability where an authenticated user with limited editing permissions can escalate their privileges to admin by exploiting improper permission preservation in the API. Specifically, the PATCH request to /api/v1/users/{id} accepts a permissions array where the admin flag can be set by the user, as the API only removes the superuser key but not the admin key. This allows privilege escalation to admin roles. The issue is tracked as CVE-2026-44832 and is fixed in version 8.4.1.

An authenticated user with users.edit permission can escalate their privileges to admin, gaining full administrative control over the Snipe-IT system. This could lead to unauthorized access to sensitive asset and license management data and administrative functions. There are no known exploits in the wild at this time.

Upgrade Snipe-IT to version 8.4.1 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 8.4.1, applying this official update fully mitigates the issue. No other mitigation is indicated.