CVE-2026-55475: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55475 Overview

CVE-2026-55475 is an authorization flaw [CWE-863] in Snipe-IT, an open-source IT asset and license management system. Versions prior to 8.6.1 allow an authenticated user with CSV import capabilities and a valid API key to overwrite the created_by value on an import file. This lets an attacker forge ownership metadata on import records, misattributing actions to other users. The issue is fixed in Snipe-IT 8.6.1.

Critical Impact
Authenticated attackers with import privileges can tamper with import ownership metadata, breaking audit accountability and enabling repudiation of actions taken through the Importer API.

Affected Products

Snipe-IT versions prior to 8.6.1
Snipe-IT Importer API endpoint
Deployments using CSV import functionality with API key authentication

Discovery Timeline

2026-07-10 - CVE-2026-55475 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55475

Vulnerability Analysis

The vulnerability resides in the Importer API endpoint of Snipe-IT. When a user with CSV import capabilities submits an import request, the application accepts a client-supplied created_by value and persists it on the import record. The server does not restrict this field to the authenticated user's identity, so any valid API key holder with import rights can assign import ownership to another user.

This is a broken access control issue mapped to [CWE-863] Incorrect Authorization. The integrity of import metadata is compromised, though confidentiality and availability are not affected. Successful abuse enables an attacker to obscure the true origin of asset imports, disrupt forensic reconstruction, and repudiate malicious modifications to inventory data.

Root Cause

The root cause is a missing server-side authorization check on the created_by attribute in app/Http/Requests/ItemImportRequest.php. The application unconditionally assigned the field from request state instead of enforcing it based on the authenticated session identity. The patched code preserves an existing created_by value only when appropriate, but the underlying defect was trusting client-controlled input for an ownership field.

Attack Vector

Exploitation requires network access to the Snipe-IT instance, a valid API key, and CSV import privileges. The attacker submits an import request through the Importer API and supplies a created_by value pointing to a different user account. User interaction is required in the sense that a privileged user must initiate the request, matching the CVSS UI:R vector component.

php

// Vulnerable code path in app/Http/Requests/ItemImportRequest.php
$classString = "App\\Importer\\{$class}Importer";
$importer = new $classString($filename);
$import->field_map = request('column-mappings');
- $import->created_by = auth()->id();
+ $import->created_by = $import->created_by ?? auth()->id();
$import->save();

Source: GitHub commit 39fbe98

The patch changes the assignment so that the authenticated user's ID is only used as a fallback, but the fix relies on upstream request validation to reject attacker-supplied values. Review the GitHub Security Advisory GHSA-5wx7-xq8j-v4qm for full remediation context.

Detection Methods for CVE-2026-55475

Indicators of Compromise

Import records in the Snipe-IT database where created_by does not match the API key or session that submitted the request.
Application logs showing POST requests to the Importer API endpoint containing a created_by parameter in the body.
Discrepancies between web server access logs and the audit trail of import ownership in the Snipe-IT UI.

Detection Strategies

Correlate API authentication events with the created_by column in the imports table to identify mismatches.
Deploy a web application firewall rule that flags Importer API requests carrying an unexpected created_by field.
Audit historical imports for ownership assigned to accounts that lack import privileges or were inactive at the time.

Monitoring Recommendations

Enable verbose request logging on the Importer API and forward logs to a centralized SIEM for retention.
Alert on import submissions originating from API keys tied to service accounts if those accounts should not be creating imports.
Track the volume and frequency of imports per user to detect anomalous automation against the endpoint.

How to Mitigate CVE-2026-55475

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.1 or later, which contains the fix.
Rotate API keys for any account with import.create capability if abuse is suspected.
Review recent import records and reconcile the created_by value against authentication logs.

Patch Information

The fix is delivered in Snipe-IT release v8.6.1 via pull request #19072 and commit 39fbe98. The change modifies app/Http/Requests/ItemImportRequest.php so that the created_by field is no longer blindly overwritten by request input. Administrators should validate the upgrade in a staging environment before promoting to production.

Workarounds

Restrict import privileges to a minimal set of trusted administrator accounts until the patch is applied.
Revoke API keys that are not required for automation and enforce short expiration windows on the remaining keys.
Place the Snipe-IT Importer endpoint behind a reverse proxy that strips unexpected created_by parameters from the request body.

bash

# Verify installed Snipe-IT version and upgrade to the patched release
php artisan --version
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.1
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear