CVE-2026-38533 | THREATINT

Description

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

PUBLISHED Reserved 2026-04-06 | Published 2026-04-14 | Updated 2026-04-16 | Assigner mitre

References

github.com/...ity-Advisories/blob/main/CVE-2026-38533/poc.md exploit

snipeitapp.com/

github.com/...O/Security-Advisories/tree/main/CVE-2026-38533

cve.org (CVE-2026-38533)

nvd.nist.gov (CVE-2026-38533)

Download JSON