Is there a patch available for CVE-2026-55478?

Yes, a patch is available for CVE-2026-55478. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55478

Q: What is the CVSS score of CVE-2026-55478?

CVE-2026-55478 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42986 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 GitHub_M

GHSA-crv3-j83j-f3r6

Authentication Bypass Snipe It Grokability

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authorized user with low privileges triggers low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 11:03 vuln.today

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:28 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This issue is fixed in version 8.6.2.

AnalysisAI

An authorization bypass in Snipe-IT before 8.6.2 allows low-privilege users with kit edit permissions to attach licenses, consumables, or accessories they are not authorized to view into predefined kits. No active exploitation or public exploit code has been identified.

Technical ContextAI

The vulnerability is an authorization bypass (CWE-639) in the API endpoint POST /api/v1/kits/{kit_id}/licenses (and similar for consumables and accessories). The controller only validated the caller's 'kits.edit' permission but failed to verify the 'view' permission on the requested resource ID. The fix adds explicit authorization checks using the model's policy (e.g., License::findOrFail then authorize). CPE: cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:* (all versions before 8.6.2).

RemediationAI

Upgrade to Snipe-IT version 8.6.2 or later. The vendor-released patch is available at https://github.com/grokability/snipe-it/releases/tag/v8.6.2. No workarounds are needed; the fix adds proper authorization checks.