PT-2026-57289 · Snipe-It · Snipe-It
CVE-2026-55479
·
Published
2026-07-10
·
Updated
2026-08-28
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Snipe-IT versions prior to 8.6.2
Description
An authorization flaw exists in the legacy single-seat license checkin flow. The system incorrectly validates the action using the checkout permission instead of the checkin permission. This allows a user with permissions to assign licenses, but not unassign them, to access the legacy checkin endpoint and reclaim a license seat assigned to another user or asset.
Recommendations
Update to version 8.6.2.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Snipe-It