CVE-2024-5685

Published June 14th, 2024

View on NVD ↗

CVSS v3

7.6

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

grokability/snipe-it

A free open source IT asset/license management system

GitHub

13.9K