Snipe-IT Improper Privilege Management Vulnerability (CVE-2026-55843)

Executive Summary

A vulnerability in Snipe-IT, tracked as CVE-2026-55843 with a CVSS score of 7, involves improper privilege management. This issue allows attackers to manipulate user permissions, potentially leading to privilege escalation and loss of administrative access. The vulnerability affects Snipe-IT versions prior to 8.6.0.

Technical Analysis

The vulnerability is classified as an Improper Privilege Management issue (CWE-269). It resides in the `UsersController`'s `update()` method, which passes the `permission` request field to `NormalizePermissionsPayloadAction`. If the `permission` field is absent, an empty array is returned, causing all permissions, including the `admin` flag, to be discarded when the target user is an admin or superuser. This can lead to permanent loss of administrative access without any notification.

How It Gets Exploited

An attacker with administrative privileges can exploit this vulnerability by sending a `PUT /users/{id}` request for another admin user without including the `permission` field. This action results in the target admin user losing their `admin` flag and all granular permissions, effectively removing their administrative access. A secondary exploitation path exists for non-admin users with the `users.edit` permission, allowing them to target regular users and wipe their granular permissions.

Impact Assessment

The vulnerability affects Snipe-IT versions prior to 8.6.0. Successful exploitation can lead to privilege escalation, loss of administrative access, and manipulation of user permissions. The CVSS score for this vulnerability is 7, indicating a high severity level.

Recommended Actions

To mitigate this vulnerability, users should update Snipe-IT to version 8.6.0 or later. Additionally, administrators should review user permissions and monitor for any suspicious activity, especially changes to administrative access or permissions.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-j5g3-42wp-gqm3 - CVE-2026-55843: https://nvd.nist.gov/vuln/detail/CVE-2026-55843