Is there a patch available for CVE-2026-55476?

Yes, a patch is available for CVE-2026-55476. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55476

Q: What is the CVSS score of CVE-2026-55476?

CVE-2026-55476 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42989 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 GitHub_M

GHSA-53jc-27pc-x8r8

Authentication Bypass Snipe It Grokability

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requiring low-privileged authentication (PR:L); impact is limited to integrity of asset request state with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:29 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.

Articles & Coverage 1

medium.com CVE-2026-55476: IDOR in Snipe-IT Allows Any User to Cancel Asset Requests as Admin Jul 02, 2026

AnalysisAI

Missing authorization on Snipe-IT's asset request cancellation endpoint prior to version 8.6.0 allows any authenticated low-privileged user to cancel another user's pending asset requests by supplying a victim's user ID in the URL path segment. The cancel_by_admin path parameter is accepted without server-side privilege verification, constituting a CWE-862 (Missing Authorization) flaw - effectively a broken object-level authorization issue on an administrative action. No public exploit has been identified at time of analysis, and CVSS 4.0 scoring (5.3) reflects limited scope: integrity-only impact with no data exposure or availability loss.

Technical ContextAI

Snipe-IT is an open-source PHP-based IT asset and license management platform developed by Grokability (CPE: cpe:2.3:a:grokability:snipe-it). The vulnerable endpoint is POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}, where optional URL path segments allow callers to pass administrative flags and target user IDs directly in the route. CWE-862 (Missing Authorization) identifies the root cause: the application exposes an administrative action through URL path parameters but performs no server-side check to confirm the caller holds the required authority before executing the cancellation. This is a classic broken object-level authorization (BOLA/IDOR) variant where access control is implied by route convention rather than enforced by server logic.

RemediationAI

Upgrade Snipe-IT to version 8.6.0, which resolves the missing authorization check on the cancel_by_admin URL path parameter. The patched release is available at https://github.com/grokability/snipe-it/releases/tag/v8.6.0, with the underlying fixes applied in commits 3c1b18919afbba12d419a9795929493b0391c91a and ac2162113d9e25e4c61b61916ce67fb2a1050553. If immediate upgrade is not feasible, a WAF rule or reverse-proxy policy can be applied to reject POST requests to the /account/request/ endpoint that include the cancel_by_admin path segment unless the session belongs to an admin role - though this risks disrupting legitimate admin cancellation workflows and must be tested carefully. Organizations should also audit application logs for non-admin users invoking the cancel_by_admin path segment as a detection measure for retroactive exploitation.