CVE-2026-55843: Snipe-IT: Improper Privilege Management
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55843?
CVE-2026-55843 has a risk score of 51, indicating a moderate level of severity.
What kind of vulnerability is identified in CVE-2026-55843?
CVE-2026-55843 is an improper privilege management vulnerability affecting Snipe-IT prior to version 8.6.0.
How do I fix CVE-2026-55843?
To mitigate CVE-2026-55843, upgrade Snipe-IT to version 8.6.0 or later.
What impact does CVE-2026-55843 have on Snipe-IT users?
CVE-2026-55843 can lead to unauthorized modification of user permissions, potentially compromising user access controls.
Who is affected by CVE-2026-55843?
Any user or system relying on Snipe-IT versions prior to 8.6.0 may be affected by CVE-2026-55843.