Authorization bypass through user-controlled key in snipe-it - CVE-2026-55478
Published: August 14, 2026
Vulnerability identifier: #VU142559
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55478
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify kit contents by associating an unauthorized license.
The vulnerability exists due to improper access control in the POST /api/v1/kits/{kit_id}/licenses endpoint when handling requests that add a license to a predefined kit. A remote user can send a specially crafted request referencing a license they should not be allowed to access to modify kit contents by associating an unauthorized license.
The issue only checks whether the caller can edit kits and does not perform object-level authorization on the referenced license.
Affected software
snipe-it
How to mitigate CVE-2026-55478
Install security update from vendor's website.
snipe-it - update to 8.6.2