CVE-2026-55478: Snipe-IT Authorization Bypass Vulnerability

CVE-2026-55478 Overview

CVE-2026-55478 is a broken access control vulnerability in Snipe-IT, an open-source IT asset and license management system. The flaw resides in the POST /api/v1/kits/{kit_id}/licenses endpoint of the PredefinedKitsController. The endpoint verifies that the caller holds kits.edit permission but does not authorize access to the referenced license object. A low-privilege user with predefined-kit permissions can therefore bind arbitrary license records they should not be able to view or manage into a kit. The issue is classified as CWE-639: Authorization Bypass Through User-Controlled Key and affects all versions of Snipe-IT prior to 8.6.2.

Critical Impact
Authenticated users with kit-editing privileges can associate and expose licenses they lack authorization to access, undermining tenant data segregation within Snipe-IT.

Affected Products

Snipe-IT versions prior to 8.6.2
snipeitapp:snipe-it API endpoint POST /api/v1/kits/{kit_id}/licenses
Deployments where non-admin users are granted kits.edit permission

Discovery Timeline

2026-07-10 - CVE-2026-55478 published to NVD
2026-07-10 - Last updated in NVD database
Fixed in release - Snipe-IT v8.6.2 published on GitHub with commit 0d870d5

Technical Details for CVE-2026-55478

Vulnerability Analysis

Snipe-IT allows administrators to build predefined kits that bundle assets, accessories, consumables, and licenses for streamlined issuance. The API route POST /api/v1/kits/{kit_id}/licenses accepts a license_id in the request body and attaches that license to the specified kit. Before the patch, the controller enforced only a function-level check confirming the caller could edit kits. It performed no object-level authorization against the license identified by license_id. Any authenticated user holding the kits.edit permission could therefore reference a license they did not own or have visibility into and attach it to a kit. Once bound, the license metadata becomes retrievable through kit listing endpoints.

Root Cause

The controller conflated function-level access ("can this user edit kits?") with object-level access ("can this user use this specific license?"). The referenced License model was resolved directly from the untrusted license_id parameter without an ownership or permission check, matching the [CWE-639] pattern.

Attack Vector

Exploitation requires network access to the Snipe-IT API and valid credentials for an account with kits.edit privileges. The attacker enumerates or guesses license_id values and submits crafted POST requests to /api/v1/kits/{kit_id}/licenses to bind restricted licenses into a kit under their control.

php

 use App\Http\Controllers\Controller;
 use App\Http\Transformers\PredefinedKitsTransformer;
 use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Accessory;
+use App\Models\Consumable;
+use App\Models\License;
 use App\Models\PredefinedKit;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;

Source: GitHub commit 0d870d5 — the patch imports the License, Accessory, and Consumable models so the controller can resolve the referenced object and evaluate object-level authorization before attaching it to a kit.

Detection Methods for CVE-2026-55478

Indicators of Compromise

Unexpected POST /api/v1/kits/{kit_id}/licenses requests from user accounts that do not normally manage licenses.
Kits containing licenses whose owners or departments differ from the kit creator.
API audit entries showing license_id values referenced by users lacking direct license permissions.

Detection Strategies

Review Snipe-IT application logs and web server access logs for calls to /api/v1/kits/*/licenses correlated with non-admin API tokens.
Query the predefined_kits and license pivot tables for associations created before upgrading to 8.6.2 by users without license visibility.
Alert on API tokens issued to low-privilege users generating a high ratio of kits/*/licenses POSTs relative to baseline.

Monitoring Recommendations

Forward Snipe-IT application and reverse-proxy logs to a centralized SIEM or data lake for retention and correlation.
Enable Laravel activity logging on the PredefinedKit and License models to capture attach and detach events with actor identity.
Establish behavioral baselines for API usage per role and alert on deviations targeting the kits API surface.

How to Mitigate CVE-2026-55478

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which introduces object-level authorization on kit license binding.
Audit all predefined kits for licenses that were attached by users without direct rights to those licenses and detach any unauthorized associations.
Rotate API tokens belonging to accounts that hold kits.edit permission if unauthorized kit modifications are identified.

Patch Information

The fix is delivered in Snipe-IT v8.6.2. See the GitHub Security Advisory GHSA-crv3-j83j-f3r6, the v8.6.2 release notes, and the remediation commit 0d870d5. The patch imports the License, Accessory, and Consumable models into PredefinedKitsController so the controller can resolve and authorize each referenced object rather than trusting the client-supplied identifier.

Workarounds

Restrict the kits.edit permission to trusted administrators until the upgrade to 8.6.2 is completed.
Place the Snipe-IT API behind an authenticating reverse proxy or WAF rule that blocks POST /api/v1/kits/*/licenses for non-admin identities.
Disable API tokens for accounts that do not require programmatic access to kits.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear && php artisan cache:clear