CVE-2026-55516

Published: Jul 10, 2026Modified: Jul 14, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.

Affected (1)

Products: Snipeitapp: Snipe It

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snipeitapp Snipe It	Before 8.6.2

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/grokability/snipe-it/commit/905d498ecdb0ee5591231c97bf48435e92044368

Source: security-advisories@github.com

Patch

https://github.com/grokability/snipe-it/releases/tag/v8.6.2

Source: security-advisories@github.com

Release Notes

https://github.com/grokability/snipe-it/security/advisories/GHSA-575r-357h-fhch

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.