🚨 CVE-2026-85617
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
🎖@cveNotify
GitHub
Bulk User Delete Authorization Bypass
### Impact:
A restricted user can soft-delete users outside their authorized scope (such as users in other companies or higher-privileged users). This leads to unauthorized data modification and ...
September 4, 2026 64
