Which versions of Snipe It are affected by CVE-2026-55843?

Snipe-IT versions before 8.6.0 contain a permission-handling vulnerability allowing administrators to silently strip administrative access from other accounts, including other administrators.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55843?

Yes, a public proof-of-concept exploit is available for CVE-2026-55843. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55843?

Within 24 hours: Review Snipe-IT audit logs for recent unauthorized permission revocations; export a list of all users with Admin role or users.edit permission; implement available access controls (IP whitelisting, MFA) for user management functions if supported. Within 7 days: Back up production Snipe-IT database; test and validate Snipe-IT 8.6.0 or later upgrade in staging environment; create upgrade runbook and rollback plan. Within 30 days: Execute production upgrade to Snipe-IT 8.6.0 or later; verify all user permissions post-upgrade; audit permission changes made prior to upgrade for suspicious activity.

Snipe It CVE-2026-55843

Q: What is the CVSS score of CVE-2026-55843?

CVE-2026-55843 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42985 HIGH

Improper Privilege Management (CWE-269)

2026-07-10 GitHub_M

GHSA-j5g3-42wp-gqm3

Privilege Escalation Snipe It Grokability

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:20 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.

AnalysisAI

Improper permission handling in Snipe-IT before 8.6.0 lets a privileged user strip another user's administrative or granular permissions when editing their account. Because UsersController::update() treats a missing permissions field as a sparse payload rather than a no-op, an administrator editing another administrator — or any user holding users.edit editing a regular account — can silently wipe the target's privileges. No public exploit identified at time of analysis; this is an authenticated integrity/availability issue rather than a remote takeover.