CVE-2026-55643

Katalog CVE

CVSS 8.8 · High EPSS 0,30%

Kerentanan Incorrect Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-c6w2-j4wq-mvwg patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.3 release notes · patch