High severity8.8NVD Advisory· Published Sep 4, 2026

CVE-2026-85617

Description

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Snipe IT/Snipe-ITllm-fuzzy
Range: <8.6.3
Grokability/Snipe Itllm-fuzzy
Range: <8.6.3

Patches

Vulnerability mechanics

References

github.com/grokability/snipe-it/security/advisories/GHSA-mx3g-8v84-j6ggnvd
www.vulncheck.com/advisories/snipe-it-before-8.6.3-authorization-bypass-via-bulk-deletenvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000