CVE-2026-55479 in Snipe-IT
Summary
by MITRE • 07/10/2026
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/10/2026
This vulnerability exists within Snipe-IT's legacy single-seat license management system where the authorization logic fails to properly validate user permissions during the license checkin process. The flaw stems from an incorrect permission check implementation that allows users with checkout privileges to bypass proper access controls and execute checkin operations through deprecated endpoints. This misconfiguration creates a privilege escalation scenario where individuals who should only have the ability to assign licenses can leverage their checkout permissions to reclaim license seats from other users or assets, effectively circumventing intended access controls.
The technical nature of this vulnerability aligns with CWE-284 which addresses improper access control and CWE-306 which covers missing security checks. The flaw operates through a permission validation bypass mechanism where the system incorrectly grants access to the checkin endpoint based on checkout permissions rather than enforcing proper checkin-specific authorization requirements. This represents a classic case of insufficient authorization checking within the application's access control framework, allowing unauthorized users to perform operations they should not be permitted to execute.
The operational impact of this vulnerability is significant as it enables malicious or unauthorized users to reclaim license seats that have been assigned to other users or assets without proper authorization. This creates potential for license misuse, resource exhaustion, and unauthorized access to licensed software resources. The vulnerability particularly affects organizations relying on precise license tracking and management, as it allows for unauthorized license reallocation that could result in compliance violations or operational disruptions in environments where license usage must be strictly controlled.
Organizations utilizing Snipe-IT versions prior to 8.6.2 should immediately implement the available patch to address this authorization bypass vulnerability. The fix in version 8.6.2 properly enforces checkin permissions and ensures that only users with appropriate authorization can execute checkin operations. Additionally, security teams should review existing user roles and permissions to ensure proper segregation of duties, and implement monitoring for unauthorized license reallocation attempts. This vulnerability demonstrates the critical importance of proper access control implementation and regular security assessments to prevent privilege escalation scenarios that could compromise asset management systems. The issue also highlights potential ATT&CK tactics related to privilege escalation and defense evasion through improper access control mechanisms that allow unauthorized users to manipulate system resources without detection.