CVE-2026-55483
Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
- Record
CVE-2026-55483- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-62679
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
- Record
EUVD-2026-62679- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf68-g98v-wp9g
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Impact
The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.
The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.
Patches
Patched in aea3877718
- Record
GHSA-hf68-g98v-wp9g- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
- Record
CVE-2026-55483- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
- Record
CVE-2026-55483- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-hf68-g98v-wp9g
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Impact
The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.
The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.
Patches
Patched in aea3877718
- Record
GHSA-hf68-g98v-wp9g- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snipe/snipe-itPackagist |
before 8.6.0 | 8.6.0 |
snipe/snipe-itPackagist |
before 8.6.0, plus listed versions 3.2.0v0.1.0v0.1.1v0.1.2v0.2.0 Show 45 moreShow lessv0.3.0-alphav0.3.10-alphav0.3.11-alphav0.3.7-alphav0.3.8-alphav0.3.9-alphav1.0v1.1v1.2.0v1.2.1v1.2.10v1.2.11v1.2.2v1.2.3v1.2.3-betav1.2.4v1.2.4-betav1.2.5v1.2.6v1.2.6-betav1.2.6.1v1.2.7v1.2.7-betav1.2.8v1.2.9v2.0v2.0-RC-1v2.0-betav2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.2v3.0v3.0-alphav3.0-alpha2v3.0-beta.1v3.0-beta.2v3.0-beta.3v3.0.0-betav3.1.0 |
8.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55483 is a medium vulnerability (CVSS 4.9) in Grokability Snipe-it, published June 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in snipe/snipe-it 8.6.0.
References
github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g
nvd.nist.gov/vuln/detail/CVE-2026-55483
Left out here: 226 versions. The JSON record has them.