--- title: "CVE-2024-5685" date: "2024-06-14T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-5685/" --- # CVE-2024-5685 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: May 22, 2024 CVE-2024-5685 **Published:** Jun 14, 2024 CWE-862 CWE-862 Missing Authorization 7.6 High Severity authorization bfla broken function level php DF Davide Ferreira Reported by Checkmarx Zero Details Overview ## Summary A Broken Function Level Authorization (BFLA) vulnerability in UsersController.php allows users with certain permissions can promote or demote themselves or other users by performing changes to the group’s memberships via API call. ## Product This vulnerability affects `snipe-it` from v4.6.17 through v6.4.1. ## Impact The vulnerability could be exploited by an unprivileged user to elevate their privileges to superadmin, potentially gaining access to administrative functionality and sensitive information. ## Steps to reproduce Users with the following permissions are allowed to perform group membership changes to groups with higher priviledges: 1. Users.edit permission – Determines whether the user has the ability to edit other user’s information. 2. Self.api permission – Determines if the user can create personal API keys to utilize the REST API. With these permissions, users can issue a API call to `/users/:id` with the PATCH method to modify the associated group memberships. ``` curl --location --request PATCH 'https://host/api/v1/users/' --header 'Content-Type: application/x-www-form-urlencoded' --header 'Authorization: Bearer ' --data-urlencode 'groups=' ``` ### Expected result: The API request is successful. The user’s group membership is updated to the designated group. ## Remediation A fix was released in commit [34f1ea1](https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1) for version v6.4.2, where a new verification has been introduced to check if the user that intends to perform changes has the proper permissions to do so. ## Credit This issue was discovered and reported by Checkmarx SCA Security Analyst [Davide Ferreira](https://www.linkedin.com/in/davide-ferreira/). ## Resources 1. [Pull Request](https://github.com/snipe/snipe-it/pull/14745) 2. [Commit](https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1) 3. [Release Notes](https://github.com/snipe/snipe-it/releases/tag/v6.4.2) 0 High Severity CVSS v3.1 Score 7.6 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low Advisory Timeline1. Discovered Mar 22, 2024 2. Disclosed Apr 12, 2024 The vulnerability was privately disclosed to the maintainer 3. Fixed May 22, 2024 Version v6.4.2 got released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)