Is there a public PoC exploit available for CVE-2026-55479?

Yes, a public proof-of-concept exploit is available for CVE-2026-55479. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-55479?

Yes, a patch is available for CVE-2026-55479. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55479

Q: What is the CVSS score of CVE-2026-55479?

CVE-2026-55479 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42998 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 security-advisories@github.com

GHSA-8frh-vhgh-64cf

Authentication Bypass Snipe It Snipeitapp

5.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable with low-privilege authenticated access (PR:L); no confidentiality or availability impact; integrity impact limited to unauthorized license seat reclamation within the same system (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:46 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.

AnalysisAI

Broken authorization in Snipe-IT's legacy single-seat license checkin endpoint allows authenticated users with only checkout (assign) rights to invoke the checkin (unassign) action, bypassing the intended permission boundary. Versions prior to 8.6.2 are affected; this is fixed in v8.6.2. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, but the low-complexity, network-accessible nature of the bypass makes it straightforward to exploit for any authenticated user with checkout-level access.

Technical ContextAI

Snipe-IT is an open-source PHP/Laravel IT asset and license management application. The vulnerability is classified as CWE-863 (Incorrect Authorization), arising from the legacy single-seat license checkin controller validating the requestor's checkout permission rather than the distinct checkin permission. This reflects a permission-check divergence between a legacy endpoint and a presumably corrected newer checkin flow, where two separate privilege levels - 'can assign licenses' and 'can unassign licenses' - are collapsed by the incorrect predicate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the flaw is network-reachable with low complexity and requires only a low-privilege authenticated session, consistent with this type of horizontal/vertical privilege escalation within the application's role model.

RemediationAI

Upgrade Snipe-IT to version 8.6.2 or later, which corrects the permission predicate in the legacy single-seat checkin endpoint to enforce the checkin permission rather than the checkout permission. The fix commit is at https://github.com/grokability/snipe-it/commit/80c8aa41dc813b0815db00bb44eb0fff9f89a227 and the release is tagged at https://github.com/grokability/snipe-it/releases/tag/v8.6.2. As a compensating control prior to patching, administrators should audit role assignments and either grant checkin permission to all users who currently hold checkout-only roles, or temporarily revoke checkout-only roles to prevent access to the legacy endpoint. Note that revoking checkout roles will disrupt the ability of affected users to legitimately assign licenses, so this trade-off must be weighed against the operational impact. Network-layer controls (restricting access to the Snipe-IT instance to trusted IP ranges) reduce exposure but do not eliminate the flaw for internal users.