CVE-2026-48493 is an incorrect authorization vulnerability (CWE-863) in the Snipe-IT IT asset/license management system. Users with the users.edit permission can exploit this flaw by sending a PATCH request to /api/v1/users/{their_own_id} to assign themselves additional permissions beyond their intended scope, except for admin and superuser roles. This privilege escalation risk affects all versions prior to 8.6.0. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. No known exploits in the wild have been reported. The issue is resolved in Snipe-IT version 8.6.0.

An attacker with users.edit permission can escalate privileges by granting themselves additional permissions such as assets.view, assets.create, reports.view, and import capabilities. This could lead to unauthorized access to sensitive asset and report data and unauthorized creation or import actions. The vulnerability does not allow escalation to admin or superuser roles, limiting the scope of impact. There is no reported impact on system availability.

Upgrade Snipe-IT to version 8.6.0 or later, where this authorization flaw is patched. Since the vulnerability is fixed in 8.6.0, applying this official update fully mitigates the issue. No additional mitigations are indicated or required.