MEDIUMCVSS 5.7EPSS 0.3%

CVE-2026-55475

Snipe-IT's import created_by can be overwritten

Published: 2026-08-28
Modified: 2026-08-28
EPSS percentile: 27%
Aliases: GHSA-5wx7-xq8j-v4qm
Sources: github-advisory

Summary

### Impact The `created_by` of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Packagist	snipe/snipe-it	—	8.6.1

Remediation: Upgrade to 8.6.1 or later.

References

https://github.com/advisories/GHSA-5wx7-xq8j-v4qm

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.