What is the CVSS score of CVE-2026-55460?

CVE-2026-55460 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Snipe-IT are affected by CVE-2026-55460?

Snipe-IT versions prior to 8.6.2 contain a broken authorization vulnerability allowing authenticated users without explicit delete permissions to soft-delete other user accounts through a bulk…. A patch is available.

How to fix or mitigate CVE-2026-55460?

Within 24 hours: Audit all user role assignments in Snipe-IT to identify users holding users.view and users.edit permissions; review audit logs for suspicious bulk user operations via /users/bulksave endpoint. Within 7 days: Implement application-level access restrictions by disabling bulk delete operations for non-admin roles or restricting endpoint access to admin accounts only; enforce role-based access control review. Within 30 days: Upgrade Snipe-IT to version 8.6.2 or later once released; establish continuous monitoring for authorization bypass attempts targeting the bulksave endpoint.

Snipe-IT CVE-2026-55460

EUVD-2026-42991 HIGH

Incorrect Authorization (CWE-863)

2026-07-10 GitHub_M

Authentication Bypass Snipe It

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable authenticated low-priv user (PR:L, AV:N, AC:L); impact is a reversible soft-delete of one non-admin user, so integrity and availability are Low, confidentiality None.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:25 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

AnalysisAI

Broken authorization in Snipe-IT before 8.6.2 lets an authenticated non-admin user who holds users.view and users.edit - but explicitly not users.delete - soft-delete other non-admin user accounts by POSTing delete_user=1 to /users/bulksave. The root cause is that BulkUsersController::destroy() checks only the 'update' authorization, so the delete permission gate is never enforced. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as non-admin with users.edit

Exploit

Craft POST to /users/bulksave with delete_user=1

Execution

Bypass missing delete authorization check

Impact

Soft-delete target non-admin user

Access

Authenticate as non-admin with users.edit

Exploit

Craft POST to /users/bulksave with delete_user=1

Execution

Bypass missing delete authorization check

Impact

Soft-delete target non-admin user

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated Snipe-IT session for a user/role that has been assigned the users.view and users.edit permissions but not users.delete - this specific permission combination is the prerequisite, and it reflects a common least-privilege help-desk/user-manager role. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) correctly captures a network-reachable, low-complexity attack requiring low privileges and no user interaction, with no confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An insider or a compromised low-privilege help-desk account that has been granted users.view and users.edit (but not users.delete) sends a crafted authenticated POST to /users/bulksave containing delete_user=1 and a target user ID. Because the endpoint only checks update rights, the target non-admin account is soft-deleted, disrupting that user's access without the attacker ever holding delete permission. …
Remediation	Vendor-released patch: upgrade to Snipe-IT 8.6.2, which corrects BulkUsersController::destroy() to require proper delete authorization (fix commit 374f426f0c6bb7a4f129f7b85051cc1da753a0f5, release https://github.com/grokability/snipe-it/releases/tag/v8.6.2, advisory https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Audit all user role assignments in Snipe-IT to identify users holding users.view and users.edit permissions; review audit logs for suspicious bulk user operations via /users/bulksave endpoint. …

Threat intelligence, references, and detailed analysis are available after sign-in.