Auth bypass in Grokability Snipe-It
CVE-2026-50550
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N.
Affected products
- Grokability Snipe-it — versions < 8.5.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-50550?
- CVE-2026-50550 is a medium-severity vulnerability in Grokability Snipe-It, classified under Incorrect Authorization. CVSS score: 5.8/10. Published 2026-08-19.
- How severe is CVE-2026-50550?
- Medium severity. CVSS v3 base score is 5.8 out of 10.