CVE-2026-55843: Snipe-IT Improper Privilege Management Vulnerability
Summary
CVE-2026-55843: Snipe-IT has an Improper Privilege Management issue. Affects snipe/snipe-it versions < 8.6.0. Fixed in 8.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snipe-IT is a popular open-source asset management system that allows organizations to manage their assets effectively. It provides features such as tracking assets, managing users, and assigning permissions. However, it has been found to have a significant vulnerability related to improper privilege management, which can lead to unauthorized access and loss of administrative rights.
Vulnerability Detail
The vulnerability arises from the update() method in the UsersController, which improperly handles the permission request field. When an admin user updates another admin's account without including the permission field, the target's admin flag and all granular permissions are permanently removed. This occurs without any error or notification, effectively stripping the target user of administrative access. Additionally, non-admin users with the users.edit permission can exploit this vulnerability to wipe permissions from regular accounts.
How To Fix
Minimum fixed version
8.6.0
This is the first release that contains the fix.
composer require snipe/snipe-it:8.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that when making updates to user accounts, the permission field is always included in the request, even if no changes are intended. This can prevent accidental loss of permissions.
Conclusion
The improper privilege management vulnerability in Snipe-IT (CVE-2026-55843) poses a significant risk to user accounts, particularly for admins. It is crucial to update to the patched version 8.6.0 or later to mitigate this risk and ensure proper permission handling.
See every vulnerability recorded for snipe/snipe-it →
FAQ
CVE-2026-55843 is a vulnerability in Snipe-IT that allows improper privilege management, potentially leading to unauthorized access and loss of administrative rights.
Admins who update other admin accounts without including the permission field are primarily affected, as well as non-admin users with the users.edit permission targeting regular accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, ensure that you always include the permission field when updating user accounts to avoid losing permissions.
The CVSS score of this vulnerability is 6.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for snipe/snipe-it.
