SB20260814124 - Multiple vulnerabilities in snipe-it
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-55476)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cancel other users\' pending asset requests.
The vulnerability exists due to improper access control in the POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} route when handling crafted request paths. A remote user can set the cancel_by_admin path segment to a truthy value and supply a victim\'s user ID to cancel other users\' pending asset requests.
The attacker only needs an active authenticated session, and no user interaction is required.
2) Improper access control (CVE-ID: CVE-2026-55475)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite the created_by field of an import file.
The vulnerability exists due to improper access control in the Importer API endpoint when handling import requests. A remote user can submit a crafted import request to overwrite the created_by field of an import file.
Exploitation requires CSV import capabilities and a valid API key, and user interaction is required.
3) Improper access control (CVE-ID: CVE-2026-55462)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the user detail and print inventory endpoints when handling requests for another user\'s record. A remote user can request the affected pages to disclose sensitive information.
The issue affects accounts that have only the users.view permission but lack direct access to the licenses, accessories, and consumables modules.
Remediation
Install update from vendor's website.