PT-2026-57289 · Grokability · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55479

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-55479

Affected Products

Snipe-It

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-55479 · Security Note
• https://github.com/grokability/snipe-it/commit/80c8aa41dc813b0815db00bb44eb0fff9f89a227 · Note
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 · Note
• https://github.com/grokability/snipe-it/security/advisories/GHSA-8frh-vhgh-64cf · Note