CVE-2026-49976
Received Received - Intake

Email Overwrite via CSV Import in Snipe-IT

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49976
EUVD
EUVD-2026-62675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipe-it snipe-it 8.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Snipe-IT allows a user with import permissions to overwrite a non-admin user's email address via CSV update mode. The attacker can then request a password reset to take over the account. The issue occurs because the CSV import process bypasses user-edit authorization checks, allowing unauthorized modifications to sensitive fields.

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is below 8.6.1, the system is vulnerable. Review recent CSV import logs for unusual email changes or password reset requests.

Impact Analysis

An attacker with import permissions could escalate privileges by taking over another user's account. This could lead to unauthorized access to sensitive data, manipulation of asset records, or disruption of IT asset management operations. The impact includes compromised confidentiality and integrity of user data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.1 or later immediately. Review user permissions to ensure only trusted users have import privileges. Monitor for unauthorized email changes or password reset requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart