Authorization Bypass in Snipe-IT Bulk Delete

Executive Summary

This vulnerability affects Snipe-IT versions before 8.6.3. It allows restricted users to bypass authorization checks in the bulk delete functionality. Attackers can include unauthorized user IDs in bulk delete requests to soft-delete users outside their permitted scope, including users from other companies or higher-privileged accounts.

Useful 0 Not Useful 0

Detection Guidance

Check Snipe-IT logs for bulk delete operations initiated by restricted users. Look for requests containing multiple user IDs outside their authorized scope. Review network traffic for POST requests to /api/v1/users/bulk-delete with suspicious payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data modification and denial of service for affected users. Attackers could disable or modify accounts they should not access, potentially causing disruptions in user access and data integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modification or account disabling, which may violate compliance requirements under GDPR (e.g., unauthorized access or processing of personal data) and HIPAA (e.g., unauthorized modification or deletion of protected health information). The lack of proper authorization checks undermines access control principles required by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.3 or later immediately. Temporarily restrict bulk delete permissions for non-admin users until patching is complete. Monitor user accounts for unauthorized soft-deletions or modifications.

Useful 0 Not Useful 0