What is the CVSS score of CVE-2026-55462?

CVE-2026-55462 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-55462?

Yes, a public proof-of-concept exploit is available for CVE-2026-55462. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-55462?

Yes, a patch is available for CVE-2026-55462. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55462

EUVD-2026-42994 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 security-advisories@github.com

GHSA-fc33-6w3q-538h

Authentication Bypass Snipe It Snipeitapp

4.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible web endpoint requires only a low-privilege authenticated session (users.view role); confidentiality impact is limited to partial inventory metadata with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:41 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2.

AnalysisAI

Incorrect authorization in Snipe-IT's UsersController before version 8.6.2 allows any authenticated user holding only the users.view permission to access restricted inventory and procurement metadata - including assigned licenses, accessories, consumables, and associated cost and order data - from modules their direct permissions would otherwise deny. The flaw exists in both the show() and printInventory() controller methods, which enforce authorization only for the user-viewing scope before eagerly loading and rendering related asset relationships without further permission checks. No public exploit exists and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and common assignment of users.view to helpdesk staff makes this a realistic insider access-control bypass in enterprise deployments.

Technical ContextAI

Snipe-IT is an open-source IT asset and license management system built on the Laravel PHP framework, using Eloquent ORM for relational data modeling. CWE-863 (Incorrect Authorization) describes a failure to verify that an authenticated user has the necessary permissions to access a specific resource, distinct from authentication failure. In this case, UsersController::show() and printInventory() correctly authenticate the request and check for the users.view permission, but then proceed to eager-load Eloquent relationships - licenses, accessories, consumables - and render them in the response without verifying the caller holds the corresponding module-level permissions (e.g., licenses.view, accessories.view, consumables.view). This is a broken object-level authorization pattern: the controller trusts that passing the initial gate check implies broader data access rights. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects a network-accessible web endpoint requiring only a low-privilege session with no attack complexity or user interaction needed. No CPE string was provided in the intelligence data.

RemediationAI

Upgrade Snipe-IT to version 8.6.2 or later, which resolves the incorrect authorization in UsersController::show() and printInventory() - this is the only definitive fix. The patched release is confirmed at https://github.com/grokability/snipe-it/releases/tag/v8.6.2 and the specific fix commit is at https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5. The full security advisory with additional context is available at https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h. As a compensating control prior to patching, restrict the users.view permission exclusively to staff who are already authorized to view license, accessory, and consumable data - this reduces the exposed population but degrades role separation and may impact helpdesk workflows. There is no configuration flag or feature toggle to disable the affected controller behavior without removing user-viewing functionality entirely, so workarounds are limited.