Snipe-IT, an IT asset/license management system, has a missing authorization vulnerability (CWE-862) in versions before 8.6.0. Specifically, an authenticated user with the users.create permission can escalate privileges by creating a new user account with administrative rights. The vulnerability arises because the store() function in app/Http/Controllers/Users/UsersController.php removes superuser permissions but fails to remove admin permissions, allowing privilege escalation. The vulnerability is fixed in version 8.6.0.

An attacker with the users.create permission can create new user accounts with administrative privileges, potentially gaining full administrative control over the Snipe-IT system. This could lead to unauthorized access and management of IT assets and licenses. The CVSS 4.0 base score is 4.9 (medium severity), reflecting that the attack requires authenticated user privileges but can result in high impact due to privilege escalation.

Upgrade Snipe-IT to version 8.6.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix detailed beyond upgrading. Until upgraded, restrict users with users.create permission to trusted personnel only.