Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Priority LOW 22CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed snipe-it (grokability): 8.6.0snipe/snipe-it (Packagist): 8.6.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | before 8.6.0 | 8.6.0 | Patch available | CNA |
| — | snipe/snipe-it (Packagist) | before 8.6.0 | 8.6.0 | Patch available | GHSA-hf68-g98v-wp9g |
- snipe-it Vendorgrokability Affected before 8.6.0 Fixed in 8.6.0 Patch available CNA
- snipe/snipe-it (Packagist) Vendor— Affected before 8.6.0 Fixed in 8.6.0 Patch available GHSA-hf68-g98v-wp9g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | before 8.6.0 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.6.0 Vulnerable ·grokability
Remediation
- Fix · CNA snipe-it (grokability) Fixed in 8.6.0
- Fix · GHSA-hf68-g98v-wp9g snipe/snipe-it (Packagist) Fixed in 8.6.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55483
- 2026-10-03 Alias added: GHSA-hf68-g98v-wp9g
References
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
- CVE-2026-55483 · CVE Program
- CVE-2026-55483 · NVD
- FIRST EPSS
- GHSA-hf68-g98v-wp9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences