Improper privilege management in snipe-it - CVE-2026-55843
Published: August 14, 2026
Vulnerability identifier: #VU142557
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55843
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to remove administrative and granular permissions from another user account.
The vulnerability exists due to improper privilege management in the UsersController update() method when handling a PUT /users/{id} request without the permission field. A remote privileged user can send a crafted update request to remove administrative and granular permissions from another user account.
This issue occurs when editing another account that the caller is allowed to modify, and no error, warning, or out-of-band notification is generated when the target\'s permissions are destroyed.
Affected software
snipe-it
How to mitigate CVE-2026-55843
Install security update from vendor's website.
snipe-it - update to 8.6.0