CVE-2026-55843 Snipe-IT: Improper Privilege Management

High 7.0 Published 10 Jul 2026 Updated 13 Jul 2026

Attackers can overwrite target user permissions during updates, potentially removing administrative rights or escalating privileges in Snipe-IT.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-55843?

CVE-2026-55843 is a high-severity vulnerability in Snipeitapp Snipe-It, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.

Weakness: CWE-269

Which versions are affected by CVE-2026-55843?

2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.

Package	Affected	Fixed in
`snipe/snipe-it` Packagist	All versions	`8.6.0`
`snipe/snipe-it` Packagist	All versions	`8.6.0`

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-55843?

Upgrade snipe/snipe-it to 8.6.0 or later.

Is CVE-2026-55843 being exploited?

There is no known exploitation of CVE-2026-55843 in the wild and no public exploit code.

All Snipeitapp Snipe-It vulnerabilities

Sources

Also known as GHSA-j5g3-42wp-gqm3.