CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Medium 5.3 Published 10 Jul 2026 Updated 10 Jul 2026

Low-privilege users can bind unauthorized licenses to kits due to missing object-level authorization checks in the Snipe-IT API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-55478?

CVE-2026-55478 is a medium-severity missing authorization vulnerability in Snipeitapp Snipe-It, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This issue is fixed in version 8.6.2.

Weakness: CWE-639

Which versions are affected by CVE-2026-55478?

2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.

Package	Affected	Fixed in
`snipe/snipe-it` Packagist	All versions	`8.6.2`
`snipe/snipe-it` Packagist	All versions	`8.6.2`

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-55478?

Upgrade snipe/snipe-it to 8.6.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-55478 being exploited?

There is no known exploitation of CVE-2026-55478 in the wild and no public exploit code.

All Snipeitapp Snipe-It vulnerabilities

Sources

Also known as GHSA-crv3-j83j-f3r6.