VulnerabilityAwaiting Analysis

CVE-2026-50550

Snipe-IT is an IT asset/license management system.

MEDIUM 5.8EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.

CVSS 3.1: 5.8 MEDIUMCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
EPSS: 0.18% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: security-advisories@github.com

References

https://github.com/grokability/snipe-it/commit/046ef82c6501be14df597f0bf5d0de2566c7d6bc
https://github.com/grokability/snipe-it/releases/tag/v8.5.0
https://github.com/grokability/snipe-it/security/advisories/GHSA-6x4j-8954-5hxm

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.