What is the CVSS score of EUVD-2026-43001?

EUVD-2026-43001 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-43001?

Yes, a patch is available for EUVD-2026-43001. Update the affected software to the latest version immediately.

Snipe-IT EUVD-2026-43001

| CVE-2026-55475 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 security-advisories@github.com

GHSA-5wx7-xq8j-v4qm

Authentication Bypass Snipe It Snipeitapp

5.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Requires valid API key and import role (PR:L); no second-party interaction is described (UI:N); impact confined to integrity of ownership metadata (I:H, C:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:45 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.

AnalysisAI

Unauthorized modification of import ownership metadata in Snipe-IT prior to version 8.6.1 allows an authenticated user with CSV import capabilities to overwrite the created_by field on import records via the Importer API endpoint. The flaw stems from insufficient authorization enforcement (CWE-863) on the created_by parameter during CSV import operations, enabling a low-privileged API user to falsify asset audit trails and attribution records. No public exploit code has been identified and this vulnerability is absent from CISA KEV; a vendor-released patch is available in v8.6.1.

Technical ContextAI

Snipe-IT is an open-source PHP-based IT asset and license management platform (grokability/snipe-it on GitHub). Its Importer API endpoint processes CSV files for bulk ingestion of asset and license data. The root cause is CWE-863 (Incorrect Authorization): the application accepts a caller-supplied created_by value in the import payload without verifying whether the authenticated user has authority to assign ownership to an arbitrary account. This allows any user whose role includes CSV import capability to substitute a different user identifier in the created_by field, bypassing the implicit expectation that import records are attributed to the submitting user. No CPE strings were included in the input data.

RemediationAI

Upgrade Snipe-IT to version 8.6.1 or later, which resolves the issue via commit 39fbe983132feca2ef15c1c0200fcc77c23a1434 (https://github.com/grokability/snipe-it/commit/39fbe983132feca2ef15c1c0200fcc77c23a1434) merged through pull request #19072 (https://github.com/grokability/snipe-it/pull/19072). The security advisory is published at https://github.com/grokability/snipe-it/security/advisories/GHSA-5wx7-xq8j-v4qm. If immediate upgrade is not feasible, restrict the CSV import API capability to administrator-level accounts only within Snipe-IT's role configuration, minimizing the number of principals who could submit a forged created_by value. Note that this workaround may disrupt operational workflows for teams relying on delegated bulk import access.