Headline
GHSA-544r-fc65-v832: Snipe-IT allows users to promote or demote themselves or other users
Users with “User:edit” and “Self:api” permissions can promote or demote themselves or other users by performing changes to the group’s memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Snipe-IT allows users to promote or demote themselves or other users
High severity GitHub Reviewed Published Jun 14, 2024 to the GitHub Advisory Database • Updated Jun 17, 2024