Snipe-IT, an IT asset/license management system, contains an incorrect authorization vulnerability (CWE-863) in versions before 8.6.1. A user possessing import permission can exploit the CSV update mode to overwrite the email address of another non-admin user. The vulnerability occurs because the UserImporter.php file attempts to restrict edits to certain fields by unsetting them, but the ItemImporter.php file's sanitizeItemForUpdating() method reconstructs the update array from raw CSV data, reintroducing unauthorized changes. The import controller checks only for import permission and does not require users.edit permission, enabling this privilege escalation. The vulnerability is resolved in version 8.6.1.

An attacker with import permission can take over non-admin user accounts by changing their email addresses and triggering password resets. This leads to full account compromise of targeted users, impacting confidentiality and integrity of user accounts. The vulnerability does not affect availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity.

Upgrade Snipe-IT to version 8.6.1 or later, where this authorization flaw is fixed. No other mitigation is documented. Users should ensure that import permissions are granted only to fully trusted users until the upgrade is applied.