Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the PATCH process to /api/v1/users/theirownid when a user has both users.edit and api permissions. An attacker can escalate their own privileges b...