CVE-2026-55475 PUBLISHED

Snipe-IT: Import created_by can be overwritten

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 10.07.2026 Updated: 10.07.2026

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS Score: 5.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	grokability
Product	snipe-it
Versions	Version < 8.6.1 is affected

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-5wx7-xq8j-v4qm
https://github.com/grokability/snipe-it/pull/19072
https://github.com/grokability/snipe-it/commit/39fbe983132feca2ef15c1c0200fcc77c23a1434
https://github.com/grokability/snipe-it/releases/tag/v8.6.1

Problem Types

CWE-863: Incorrect Authorization CWE