Authorization Bypass in Snipe-IT Leads to User Data Exposure

Executive Summary

This vulnerability exists in Snipe-IT, an IT asset/license management system, in versions prior to 8.6.1. The GET /api/v1/{object}/selectlist API endpoint lacks an authorization check, allowing any logged-in user to retrieve a paginated list of all user accounts using only their web session cookie.

No API token or elevated permissions are required to exploit this vulnerability. The exposed information includes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, or within the user's company if FMCS is enabled.

This issue was fixed in version 8.6.1 by adding the necessary authorization checks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows any authenticated user to access sensitive user account information without proper authorization.

This exposure can lead to privacy breaches, as usernames, display names, employee numbers, and user IDs are revealed.

Attackers or unauthorized users could use this information for social engineering, phishing attacks, or further exploitation within the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Snipe-IT to version 8.6.1 or later, which contains a patch that adds the missing authorization check to the GET /api/v1/{object}/selectlist API endpoint.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any logged-in user to retrieve a paginated list of all user accounts, exposing usernames, display names, employee numbers, and user IDs without requiring elevated permissions or API tokens.

This unauthorized exposure of personal and employee information could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Since the vulnerability permits access to user data without proper authorization checks, it undermines confidentiality and access control requirements mandated by these standards.

Useful 0 Not Useful 0