PT-2026-57271 · Snipe-It · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55843

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0

Description In the IT asset and license management system, the update() function within UsersController incorrectly handles missing permission request fields when processed through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction. This behavior allows an administrator updating another administrator, or a user with users.edit privileges updating a regular account, to overwrite a target user's permissions with a sparse result, effectively removing their administrative or granular permissions.

Recommendations Update to version 8.6.0.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-55843

Affected Products

Snipe-It

References · 6

• https://github.com/grokability/snipe-it/security/advisories/GHSA-j5g3-42wp-gqm3 · Vendor Advisory
• https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-55843 · Security Note
• https://github.com/grokability/snipe-it/releases/tag/v8.6.0 · Note
• https://twitter.com/infoflowcloud/status/2075667902275993795 · Twitter Post
• https://twitter.com/CVEnew/status/2075666972084203520 · Twitter Post