What is the CVSS score of CVE-2026-55462?

CVE-2026-55462 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-55462?

Yes, a patch is available for CVE-2026-55462. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55462

EUVD-2026-42994 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 security-advisories@github.com

Authentication Bypass Snipe It

4.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible web endpoint requires only a low-privilege authenticated session (users.view role); confidentiality impact is limited to partial inventory metadata with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:41 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2.

AnalysisAI

Incorrect authorization in Snipe-IT's UsersController before version 8.6.2 allows any authenticated user holding only the users.view permission to access restricted inventory and procurement metadata - including assigned licenses, accessories, consumables, and associated cost and order data - from modules their direct permissions would otherwise deny. The flaw exists in both the show() and printInventory() controller methods, which enforce authorization only for the user-viewing scope before eagerly loading and rendering related asset relationships without further permission checks. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or hold users.view credentials

Delivery

Authenticate to Snipe-IT web interface

Exploit

Request /users/{id} or printInventory endpoint

Execution

Controller checks only users.view gate, skips module permission checks

Persist

Application eager-loads license, accessory, consumable relationships

Impact

Read restricted cost and order metadata from rendered response

Access

Obtain or hold users.view credentials

Delivery

Authenticate to Snipe-IT web interface

Exploit

Request /users/{id} or printInventory endpoint

Execution

Controller checks only users.view gate, skips module permission checks

Persist

Application eager-loads license, accessory, consumable relationships

Impact

Read restricted cost and order metadata from rendered response

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session in Snipe-IT with at minimum the users.view permission - this is the only prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is an accurate representation of real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated helpdesk technician with only the users.view role navigates to another user's profile page at /users/{id} or accesses the printInventory endpoint in Snipe-IT before version 8.6.2. The controller loads and renders all assigned licenses (including license keys and seat costs), accessories, and consumables for that user without checking whether the requesting technician holds the corresponding module-level view permissions. …
Remediation	Upgrade Snipe-IT to version 8.6.2 or later, which resolves the incorrect authorization in UsersController::show() and printInventory() - this is the only definitive fix. … Detailed patch versions, workarounds, and compensating controls in full report.