CVE-2026-50550
Received Received - Intake

Two-Factor Authentication Bypass in Snipe-IT

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-50550
EUVD
EUVD-2026-62677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipeit snipe-it to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50550 is a vulnerability in Snipe-IT, an IT asset management system. It allows a user with permission to edit other users to reset a superadmin's two-factor authentication (2FA) without proper authorization checks. This flaw exists in versions prior to 8.5.0 and could enable unauthorized access to administrative functions.

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is below 8.5.0, the system is vulnerable. Review API logs for unauthorized 2FA reset attempts targeting superadmin accounts.

Impact Analysis

An attacker with user edit privileges could reset a superadmin's 2FA, gaining unauthorized access to sensitive administrative functions. This could lead to data tampering, unauthorized asset modifications, or further system compromise. The attack requires low privileges and user interaction but has low complexity.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive data, potentially violating confidentiality requirements in GDPR and HIPAA. Unauthorized administrative access may lead to data breaches or improper data handling, requiring investigation and potential reporting under these regulations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.5.0 or later immediately. Review user permissions to ensure only authorized personnel can edit authentication fields. Monitor for suspicious activity related to 2FA resets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50550. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart