DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55843: CVE-2026-55843: Privilege Demotion and Access Control Bypass via Parameter Omission in Snipe-IT

#security #cve #cybersecurity

CVE-2026-55843: Privilege Demotion and Access Control Bypass via Parameter Omission in Snipe-IT

Vulnerability ID: CVE-2026-55843
CVSS Score: 7.0
Published: 2026-08-28

A comprehensive technical analysis of CVE-2026-55843, an Improper Privilege Management vulnerability (CWE-269) in Snipe-IT versions prior to 8.6.0. The vulnerability allows an authenticated editor or administrator to overwrite and strip the granular or administrative permissions of other users by omitting the permission parameter from profile update payloads. This issue has been resolved in Snipe-IT version 8.6.0.

TL;DR

In Snipe-IT prior to 8.6.0, submitting a user update request without the 'permission' field causes the application to normalize the missing value to an empty array and overwrite the target user's existing permissions, leading to complete privilege demotion.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-269
  • Attack Vector: Network
  • CVSS v4.0 Score: 7.0 (High)
  • EPSS Score: 0.00540 (Percentile: 43.02%)
  • Impact: Privilege Demotion / Integrity & Availability Loss
  • Exploit Status: PoC / Integration Tests Public
  • CISA KEV Status: Not Listed

Affected Systems

  • Snipe-IT prior to version 8.6.0
  • Snipe-IT: < 8.6.0 (Fixed in: 8.6.0)

Mitigation Strategies

  • Upgrade to Snipe-IT version 8.6.0 or newer.
  • Verify API integration scripts to ensure that partial user updates explicitly include or completely avoid touching permission properties.
  • Monitor audit logs for unexpected privilege demotions or empty permission objects.

Remediation Steps:

  1. Identify current Snipe-IT version and plan downtime for upgrade.
  2. Apply the update to version 8.6.0 or later using standard Git or composer update processes.
  3. Validate existing user permissions in the database to ensure no previous administrative accounts were inadvertently stripped.
  4. Run integration tests or manual verification checks on user profile update paths.

References

Read the full report for CVE-2026-55843 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)