MEDIUMCVSS 5.3EPSS 0.2%

CVE-2026-55479

Snipe-IT has incorrect permission for legacy license checkin API

Published: 2026-08-28
Modified: 2026-08-28
EPSS percentile: 9%
Aliases: GHSA-8frh-vhgh-64cf
Sources: github-advisory

Summary

### Impact The legacy single-seat license checkin flow authorizes the action with the `checkout` permission instead of the `checkin` permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat that is currently assigned to another user or asset.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Packagist	snipe/snipe-it	—	8.6.2

Remediation: Upgrade to 8.6.2 or later.

References

https://github.com/advisories/GHSA-8frh-vhgh-64cf

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.