CVE-2026-55462: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55462 Overview

CVE-2026-55462 is a broken authorization vulnerability in Snipe-IT, an open-source IT asset and license management system. The flaw exists in the UsersController::show() and printInventory() methods, which authorize only the user viewing action before loading and rendering assigned license, accessory, and consumable relationships. An authenticated user holding only the users.view permission can retrieve inventory data and cost/order metadata from modules whose direct permissions would otherwise deny access. The issue is classified as [CWE-863: Incorrect Authorization] and affects Snipe-IT versions prior to 8.6.2.

Critical Impact
Authenticated low-privilege users can view license, accessory, and consumable inventory data including cost and order metadata they should not be able to access.

Affected Products

Snipe-IT versions prior to 8.6.2
Self-hosted Snipe-IT deployments using role-based access control
Snipe-IT instances with users assigned only the users.view permission

Discovery Timeline

2026-07-10 - CVE-2026-55462 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55462

Vulnerability Analysis

Snipe-IT enforces granular permissions across asset modules including users, licenses, accessories, and consumables. The UsersController::show() action displays a user profile along with all inventory relationships assigned to that user. Prior to version 8.6.2, the controller checked only whether the caller could view the target user before eagerly loading and rendering related license seats, accessories, and consumables. The controller did not verify that the caller held the corresponding licenses.view, accessories.view, or consumables.view permissions on those related records.

The same authorization gap exists in printInventory(), which renders a printable inventory sheet containing the same relationship data. A user with only users.view therefore obtains license names, seat assignments, accessory allocations, and consumable checkouts, along with cost and purchase order metadata attached to those records.

Root Cause

The root cause is a missing authorization check on related models. The controller relies on a single gate covering the parent User resource and treats access to the parent as implicit access to every child relationship. Laravel's eager-loading behavior compounds the issue by resolving license, accessory, and consumable records in a single query path that bypasses per-module gates.

Attack Vector

Exploitation requires an authenticated session with the users.view permission. The attacker navigates to a target user's profile page or their printable inventory view. The rendered response includes serialized license, accessory, and consumable records with their cost, purchase order, and supplier fields. No further privilege escalation, injection, or user interaction is required.

php

// Patch excerpt from commit 374f426f0c6bb7a4f129f7b85051cc1da753a0f5
// app/Http/Controllers/Users/BulkUsersController.php
// Enforce per-item checkin permissions before touching anything
foreach ($assets as $asset) {
    if (auth()->user()->cannot('checkin', $asset)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

$licenseModels = License::whereIn('id', $licenses->pluck('license_id')->unique())->get();
foreach ($licenseModels as $license) {
    if (auth()->user()->cannot('checkin', $license)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

$accessoryModels = Accessory::whereIn('id', $accessoryUserRows->pluck('accessory_id')->unique())->get();
foreach ($accessoryModels as $accessory) {
    if (auth()->user()->cannot('checkin', $accessory)) {
        return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
    }
}

// Require delete permission before allowing user deletion.
if ($request->input('delete_user') == '1' && auth()->user()->cannot('delete', User::class)) {
    return redirect()->route('users.index')->with('error', trans('general.insufficient_permissions'));
}

Source: GitHub commit 374f426. The patch tightens per-item authorization gates across the users controllers so that access to a parent user resource no longer implies access to related licenses, accessories, or consumables.

Detection Methods for CVE-2026-55462

Indicators of Compromise

HTTP GET requests to /users/{id} or /users/{id}/print from accounts that lack licenses.view, accessories.view, or consumables.view permissions.
Spikes in profile or inventory page views by low-privilege service or auditor accounts.
Access logs showing sequential enumeration of user IDs from a single session.

Detection Strategies

Correlate Snipe-IT application logs with the role assignments stored in the permissions column of the users table to flag mismatches between viewed data and granted permissions.
Deploy web application firewall rules that log requests to the user show and printInventory endpoints for accounts outside expected administrator groups.
Monitor Laravel audit logs and database query logs for eager loads of licenseseats, accessories, and consumables triggered by non-privileged users.

Monitoring Recommendations

Enable Snipe-IT's built-in activity log and forward it to a centralized SIEM for retention and correlation.
Alert on any account viewing more than a defined threshold of unique user profiles within a short window.
Baseline typical access patterns for users.view-only accounts and alert on deviations that include inventory endpoint access.

How to Mitigate CVE-2026-55462

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which contains the authorization fix.
Audit all role definitions and remove users.view from accounts that do not require it.
Review recent access logs for anomalous profile or printable inventory views by low-privilege users.

Patch Information

The fix is delivered in Snipe-IT release v8.6.2. The corresponding GitHub Security Advisory GHSA-fc33-6w3q-538h documents the scope of the change, and the code change is available in commit 374f426. The patch adds per-item authorization gates around license, accessory, and consumable relationships in the affected controllers.

Workarounds

Restrict the users.view permission to administrative roles only until the upgrade is applied.
Place the Snipe-IT instance behind a reverse proxy that restricts access to /users/* endpoints to trusted IP ranges.
Disable the printable inventory route at the web server layer for accounts that do not require it.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
php artisan down
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear
php artisan up