Unauthorized Modification in Snipe-IT Importer API of Grokability
CVE-2026-55475

5.7MEDIUM

Key Information:

Vendor: Grokability
Status: Snipe-it
Vendor: CVE Published:; 10 July 2026

🔔 Create Grokability Vulnerability Alert

What is CVE-2026-55475?

The Snipe-IT asset management system has a critical issue in its Importer API that permits users with CSV import capabilities and valid API keys to change the 'created_by' value of an import file. This flaw enables unauthorized users to alter import ownership metadata, potentially compromising the integrity of asset management activities. This vulnerability has been resolved in version 8.6.1, and users are encouraged to upgrade to this version to mitigate the risk.