CVE-2026-38533: Snipeitapp Snipe-It

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

Affected products

• Snipeitapp Snipe-It: version 8.4.0 only

Published 2026-04-14. Last modified 2026-06-17.