CVE-2026-55483

Katalog CVE

CVSS 8.8 · High EPSS 0,35%

Kerentanan Missing Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.0 release notes · patch