PT-2026-57266 · Snipe-It · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55472

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2

Description When Full Multiple Companies Support and scope locations fmcs are enabled, the API location creation endpoint fails to terminate the process after detecting an invalid parent-child company mismatch. This allows the creation of a child location under a parent location belonging to a different company.

Recommendations Update to version 8.6.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-55472

Affected Products

Snipe-It

References · 6

• https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489 · Patch
• https://github.com/grokability/snipe-it/security/advisories/GHSA-8w8c-8mx9-52cw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55472 · Security Note
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 · Note
• https://twitter.com/infoflowcloud/status/2075667831681700142 · Twitter Post
• https://twitter.com/CVEnew/status/2075666964073132374 · Twitter Post