CVE-2026-55479 PUBLISHED

Snipe-IT: Incorrect permission for legacy license checkin API

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 10.07.2026 Updated: 10.07.2026

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor grokability
Product snipe-it
Versions
  • Version < 8.6.2 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE