CVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log

mediumCVSS 6.5CVE-2026-48492

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-07-08
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-48492

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-484920.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-48492	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] Snipe-IT: Multiple vulnerabilitiescert-bund

Recent advisories for Snipe-IT is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-55515: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets repor…nvd · 2026-07-10
unknownCVE-2026-55481: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders h…nvd · 2026-07-10
unknownCVE-2026-55479: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat lice…nvd · 2026-07-10
mediumCVE-2026-55475: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint a…nvd · 2026-07-10
mediumCVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with …nvd · 2026-07-10
unknownCVE-2026-55466: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes…nvd · 2026-07-10