CVE-2026-48492 Snipe-IT's selectlist visibility is too permissive
Authenticated users can retrieve sensitive user account details via an unprotected API endpoint, exposing usernames and IDs regardless of permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48492?
CVE-2026-48492 is a medium-severity missing authorization vulnerability in Snipeitapp Snipe-It, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
Weakness: CWE-862
Which versions are affected by CVE-2026-48492?
2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
snipe/snipe-it Packagist | All versions | 8.5.1 |
snipe/snipe-it Packagist | All versions | 8.5.1 |
Products include Snipeitapp Snipe-It.
How do I fix CVE-2026-48492?
Upgrade snipe/snipe-it to 8.5.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48492 being exploited?
There is no known exploitation of CVE-2026-48492 in the wild and no public exploit code.
Other vulnerabilities in Snipeitapp Snipe-It
- CVE-2025-63601 File upload in n/a
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Sources
Also known as GHSA-f3c5-6cw8-fg57.