What is the CVSS score of CVE-2026-55472?

CVE-2026-55472 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55472?

Yes, a patch is available for CVE-2026-55472. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55472

EUVD-2026-42990 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 GitHub_M

Authentication Bypass Snipe It

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by authentication requirement; I:L added over NVD score because attacker inserts records into another company's location hierarchy, constituting an integrity violation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:30 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This issue is fixed in version 8.6.2.

AnalysisAI

Incorrect authorization enforcement in Snipe-IT's API location creation endpoint allows an authenticated low-privilege user to create a child location under a parent location belonging to a different company, bypassing the intended multi-tenant isolation boundary. The vulnerability affects all Snipe-IT versions prior to 8.6.2 when both Full Multiple Companies Support and the scope_locations_fmcs option are simultaneously enabled. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Snipe-IT API with low-privilege credentials

Delivery

Identify a valid parent location ID belonging to a different company

Exploit

Send crafted location creation POST request with cross-company parent_id

Execution

Server detects company mismatch but fails to return early

Persist

Location record persisted under foreign company's hierarchy

Impact

Attacker gains unauthorized read/write access to cross-tenant location data

Access

Authenticate to Snipe-IT API with low-privilege credentials

Delivery

Identify a valid parent location ID belonging to a different company

Exploit

Send crafted location creation POST request with cross-company parent_id

Execution

Server detects company mismatch but fails to return early

Persist

Location record persisted under foreign company's hierarchy

Impact

Attacker gains unauthorized read/write access to cross-tenant location data

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) the attacker must hold valid Snipe-IT credentials with at least low-privilege API access; (2) the Full Multiple Companies Support (FMCS) feature must be explicitly enabled in the instance configuration - this is not a default setting; (3) the scope_locations_fmcs flag must also be enabled - this is a secondary non-default configuration option. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as medium severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated user with low-level API access in a Snipe-IT instance running FMCS with scope_locations_fmcs enabled submits a crafted POST request to the location creation API, specifying a parent_id that belongs to a different company's location hierarchy. The server detects the company mismatch but does not abort, persisting the new location record under the foreign company's parent and granting the attacker visibility into or the ability to pollute the location structure of a separate tenant.
Remediation	The primary fix is to upgrade Snipe-IT to version 8.6.2 or later, which is available at https://github.com/grokability/snipe-it/releases/tag/v8.6.2. … Detailed patch versions, workarounds, and compensating controls in full report.