CVE-2026-55472

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Incorrect Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This issue is fixed in version 8.6.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-8w8c-8mx9-52cw patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 release notes