What is the CVSS score of CVE-2026-55516?

CVE-2026-55516 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Snipe-IT are affected by CVE-2026-55516?

CVE-2026-55516 (CVSS 7.7) is a multi-tenant isolation bypass in the maintenance endpoint that allows attackers to access other customers' assets through inadequate authorization validation.. A patch is available.

How to fix or mitigate CVE-2026-55516?

Within 24 hours: Review maintenance endpoint access logs for unauthorized cross-tenant asset requests and suspicious asset_id patterns. Within 7 days: Deploy compensating controls (tenant context re-validation logic, WAF rules blocking invalid asset_id requests, network ACLs), notify affected customers of remediation timeline. Within 30 days: Apply vendor patch immediately upon release.

Snipe-IT CVE-2026-55516

EUVD-2026-42984 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 GitHub_M

Authentication Bypass Snipe It

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.7 HIGH

Authenticated API user (PR:L) over the network at low complexity; the cross-company effect makes S:C, and impact is integrity-only (I:H, C:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:18 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.

AnalysisAI

{maintenance_id} endpoint authorizes the original record and asset but trusts an attacker-supplied asset_id without re-checking company scope, breaking multi-tenant isolation (CVSS 7.7, scope-changed). No public exploit identified at time of analysis, but the upstream fix commit and GitHub Security Advisory (GHSA-575r-357h-fhch) are published.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Snipe-IT API

Delivery

Identify asset in other company

Exploit

PATCH /maintenances with foreign asset_id

Execution

Server skips asset re-authorization

Persist

Record reassigned cross-company

Impact

Tenant data integrity broken

Access

Authenticate to Snipe-IT API

Delivery

Identify asset in other company

Exploit

PATCH /maintenances with foreign asset_id

Execution

Server skips asset re-authorization

Persist

Record reassigned cross-company

Impact

Tenant data integrity broken

Vulnerability AssessmentAI

Exploitation	Requires a valid authenticated Snipe-IT account or API token (PR:L) with permission to create or edit at least one maintenance record, on a multi-company deployment where company scoping is the security boundary. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N describes a network-reachable, low-complexity, integrity-only attack requiring an existing authenticated account (PR:L) and no user interaction, rated 7.7 (High) largely because of the cross-tenant scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a legitimate low-privilege Snipe-IT account (or API token) in Company A sends a PATCH /api/v1/maintenances/{their_maintenance_id} request whose body sets asset_id to an asset ID belonging to Company B. Because the newly supplied asset is never re-authorized, the maintenance record is silently reassigned onto Company B's out-of-scope asset, corrupting another tenant's data. …
Remediation	Vendor-released patch: 8.6.2 - upgrade Snipe-IT to v8.6.2 or later (https://github.com/grokability/snipe-it/releases/tag/v8.6.2), which re-authorizes the newly supplied asset_id; the corrective change is commit 905d498ecdb0ee5591231c97bf48435e92044368 and is described in advisory GHSA-575r-357h-fhch. … Detailed patch versions, workarounds, and compensating controls in full report.