Snipe-IT versions before 8.6.0 contain an improper privilege management vulnerability (CWE-269) in the UsersController::update() method. When updating user permissions, the system processes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite the target user's permissions with a sparse set. This can cause an administrator updating another administrator, or a user with users.edit rights updating a regular user, to inadvertently remove the target's administrative or granular permissions. The vulnerability is resolved in version 8.6.0.

Exploitation of this vulnerability can lead to unintended removal of administrative or granular permissions from users, potentially disrupting user access and administrative control within the Snipe-IT system. This could affect system management and operational continuity but does not indicate privilege escalation or unauthorized access beyond the described permission removal.

Upgrade Snipe-IT to version 8.6.0 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is in version 8.6.0.