CVE-2026-55479: CVE-2026-55479: Incorrect Authorization Check in Snipe-IT Legacy License Check-in Flow

#security #cve #cybersecurity

CVE-2026-55479: Incorrect Authorization Check in Snipe-IT Legacy License Check-in Flow

Vulnerability ID: CVE-2026-55479
CVSS Score: 5.3
Published: 2026-08-28

Snipe-IT prior to version 8.6.2 is vulnerable to an incorrect authorization flaw (CWE-863) within its legacy single-seat license check-in workflow. The application incorrectly validates authorization using the 'checkout' permission instead of the 'checkin' permission. This allows authenticated users who are authorized only to assign licenses, but explicitly restricted from unassigning them, to directly access and execute license seat check-ins, bypassing intended role-based access controls.

TL;DR

An authorization logic error in Snipe-IT allows low-privilege users who only possess license checkout (assignment) permissions to bypass restrictions and execute license check-ins (reclamations), potentially disrupting asset tracking states.

Technical Details

CWE ID: CWE-863 (Incorrect Authorization)
Attack Vector: Network
CVSS v3.1 Score: 4.3 (Medium)
CVSS v4.0 Score: 5.3 (Medium)
Exploit Status: none
CISA KEV Status: False

Affected Systems

Snipe-IT installations prior to version 8.6.2
snipe-it: < 8.6.2 (Fixed in: 8.6.2)

Code Analysis

Commit: 80c8aa4

License Checkin (legacy): Fixes FD-55734 - License Single-Seat Checkin Uses Incorrect Permission Check

@@ -36,7 +36,7 @@ public function create(LicenseSeat $licenseSeat, $backTo = null)
     {
         // Check if the asset exists
         $license = License::find($licenseSeat->license_id);
-        $this->authorize('checkout', $license);
+        $this->authorize('checkin', $license);

         return view('licenses/checkin', compact('licenseSeat'))->with('backto', $backTo);
     }
@@ -70,7 +70,7 @@ public function store(Request $request, $seatId = null, $backTo = null)
             return redirect()->route('licenses.index')->with('error', trans('admin/licenses/message.checkin.error'));
         }

-        $this->authorize('checkout', $license);
+        $this->authorize('checkin', $license);

Mitigation Strategies

Upgrade the Snipe-IT instance to version 8.6.2 or later immediately.
If immediate upgrade is not possible, apply the manual PHP patch to LicenseCheckinController.php.
Audit active user roles to ensure that 'checkout' and 'checkin' permissions are correctly delineated.

Remediation Steps:

Navigate to the Snipe-IT root directory on the hosting server.
Run the standard update scripts or pull the latest stable release (v8.6.2) from the official repository.
If manually patching, locate the file 'app/Http/Controllers/Licenses/LicenseCheckinController.php'.
Replace instances of '$this->authorize("checkout", $license)' with '$this->authorize("checkin", $license)' within both the create and store methods.
Save the file and clear the application cache using the command 'php artisan cache:clear'.

References

Read the full report for CVE-2026-55479 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community