Insufficient Access Control in Snipe-IT IT Asset Management System

CVE-2026-55478

What is CVE-2026-55478?

Snipe-IT, an IT asset and license management system, experienced a vulnerability in its API allowing low-privilege users with specific kit permissions to improperly bind licenses to kits. This occurred because the system did not adequately verify access to the referenced license object during operations on the kits. Affected users could exploit this oversight to manage licenses that should be restricted, which raises significant security concerns. The issue has been resolved in version 8.6.2 of the software.

References