{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-38533", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-16T12:06:16.556Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-14T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-14T15:21:08.509Z"}, "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://snipeitapp.com/"}, {"url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38533"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "references": [{"url": "https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38533/poc.md", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T11:40:56.191221Z", "id": "CVE-2026-38533", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:06:16.556Z"}}]}, "dataVersion": "5.2"}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request."}], "id": "CVE-2026-38533", "lastModified": "2026-04-16T13:16:48.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-14T16:16:43.963", "references": [{"source": "cve@mitre.org", "url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38533"}, {"source": "cve@mitre.org", "url": "https://snipeitapp.com/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2026-38533/poc.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.4.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "snipe-it", "vendor": "snipeitapp"}], "analysis": {"en": {"generated_at": "2026-04-14T16:24:41.760083+00:00", "value": {"mitigation_remediation": ["Apply the latest Snipe\u2011IT release that contains the fix for this issue.", "If a fix is not yet released, immediately revoke the users.edit permission from all non\u2011admin accounts to prevent further unauthorized changes.", "Audit user accounts to detect any unauthorized alterations to authentication or account\u2011state fields performed after the vulnerability was discovered.", "Continuously monitor API logs for suspicious PUT requests to /api/v1/users to detect potential exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Account Hijacking via Improper Authorization"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in Snipe\u2011IT Version 8.4.0, the open\u2011source asset management web application. Only users who are not administrators but possess the users.edit permission can be targeted, while admin accounts are not affected by this specific flaw.", "description_and_impact": "An improper authorization flaw allows an attacker who is already logged in and holds users.edit permission to send a crafted PUT request to the /api/v1/users/{id} endpoint and alter sensitive authentication and account\u2011state fields for another non\u2011admin user. If exploited, this can let the attacker change another user\u2019s password, unlock or lock the account, or otherwise manipulate authentication details, effectively permitting account takeover or denial of service against that user.", "risk_and_exploitability": "The CVSS score is not disclosed, and EPSS data is unavailable; the vulnerability is not listed in the CISA KEV catalog. The attacker must first authenticate to the API with a valid credential and possess the users.edit permission, indicating that privileged access is required. Once obtained, the misuse of that permission allows modification of another user\u2019s sensitive fields, raising the potential for privilege escalation, data compromise, and service disruption. The lack of an official patch or workaround means the risk remains until an updated version is deployed or permissions are tightened."}}}}, "created": "2026-04-14T16:31:35.343460+00:00", "title": "Improper Authorization Enables Modification of Authentication Fields in Snipe\u2011IT", "updated": "2026-04-15T14:41:09.666308+00:00", "vendors": ["snipeitapp", "snipeitapp$PRODUCT$snipe-it"], "weaknesses": ["CWE-285"]}