CVE-2026-85617: Authorization Bypass Through User-Controlled Key in grokability snipe-it

The vulnerability in snipe-it versions prior to 8.6.3 allows users with limited privileges to bypass instance-level authorization controls in the bulk delete feature. By manipulating the user IDs included in bulk delete requests, attackers can perform soft-deletions on user accounts beyond their permitted scope, effectively modifying or disabling unauthorized accounts. This flaw constitutes an authorization bypass that compromises access control integrity within the application.

Exploitation of this vulnerability permits attackers with restricted privileges to disable or modify user accounts outside their authorized boundaries. This can lead to unauthorized account disruptions and potential denial of service for legitimate users. The CVSS 4.0 base score of 8.7 indicates a high severity impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

A fix is available in snipe-it version 8.6.3. Users should upgrade to version 8.6.3 or later to remediate this authorization bypass vulnerability. No vendor advisory content was provided, so patch status is based on the version information given. Patch status is confirmed by the affectedVersions field indicating versions before 8.6.3 are vulnerable.