CVE-2026-55479

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Incorrect Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-8frh-vhgh-64cf patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/80c8aa41dc813b0815db00bb44eb0fff9f89a227 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 release notes