CVE-2026-48493 is an incorrect authorization vulnerability (CWE-863) in the Snipe-IT IT asset/license management system. Users with the users.edit permission could send a PATCH request to their own user endpoint (/api/v1/users/{their_own_id}) and elevate their permissions to include any permission except admin and superuser, such as assets.view, assets.create, reports.view, and import. This flaw allows privilege escalation within the application. The vulnerability is resolved in Snipe-IT version 8.6.0.

An attacker with users.edit permission can escalate their privileges by granting themselves additional permissions, potentially increasing their access to sensitive assets, reports, and import functions. However, they cannot escalate to admin or superuser roles. This could lead to unauthorized information disclosure and unauthorized modification of asset/license data.

Upgrade Snipe-IT to version 8.6.0 or later, where this authorization vulnerability is patched. No other mitigation is indicated by the vendor advisory.