Vulnerability Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
Related Weaknesses (CWE)
References
- https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f43
- https://github.com/grokability/snipe-it/releases/tag/v8.6.0
- https://github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g
FAQ
What is CVE-2026-55483?
CVE-2026-55483 is a documented vulnerability. Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/...
How severe is CVE-2026-55483?
CVSS scoring is not yet available for CVE-2026-55483. Check NVD for updates.
Is there a patch for CVE-2026-55483?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.