CVE-2026-55516

Katalog CVE

CVSS 7.7 · High EPSS 0,38%

Kerentanan Authorization Bypass Through User-Controlled Key pada snipeitapp snipe-it. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-575r-357h-fhch patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/905d498ecdb0ee5591231c97bf48435e92044368 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 release notes