PT-2026-57289 · Grokability · Snipe-It

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-55479

Mitre

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-55479

Produtos afetados

Snipe-It

Referências · 4

• https://github.com/grokability/snipe-it/commit/80c8aa41dc813b0815db00bb44eb0fff9f89a227 · Nota
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 · Nota
• https://github.com/grokability/snipe-it/security/advisories/GHSA-8frh-vhgh-64cf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55479 · Nota de Segurança