CVE-2026-55479: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55479 Overview

CVE-2026-55479 is an authorization flaw in Snipe-IT, an open-source IT asset and license management system. The vulnerability affects the legacy single-seat license checkin flow, which incorrectly authorizes requests using the checkout permission instead of the checkin permission. A user granted the ability to assign licenses but not to unassign them can directly access the legacy checkin endpoint. This allows the attacker to reclaim a license seat currently assigned to another user or asset. The issue is classified as [CWE-863: Incorrect Authorization] and is fixed in Snipe-IT version 8.6.2.

Critical Impact
Authenticated users with checkout-only permissions can revoke license assignments from other users or assets, breaking segregation of duties in license management.

Affected Products

Snipe-IT versions prior to 8.6.2
snipeitapp/snipe-it (all deployments using the legacy single-seat checkin flow)
Self-hosted and containerized Snipe-IT instances below 8.6.2

Discovery Timeline

2026-07-10 - CVE-2026-55479 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55479

Vulnerability Analysis

Snipe-IT enforces role-based access control through Laravel policy classes. Each license action, including checkout and checkin, maps to a distinct policy method. Administrators can grant one permission without the other to enforce separation of duties. The legacy LicenseCheckinController violates this model by invoking $this->authorize('checkout', $license) when serving the checkin view. Any authenticated user who holds only the checkout permission passes this authorization gate. The user can then reach the legacy checkin endpoint and free a seat previously assigned to a different user or asset. This is a business logic and access control failure rather than a memory safety or input validation flaw.

Root Cause

The root cause is an incorrect permission string in the policy check inside app/Http/Controllers/Licenses/LicenseCheckinController.php. The controller calls the checkout policy for a checkin operation, so the runtime never evaluates the checkin ability. The permission model is intact, but the code path bypasses it.

Attack Vector

Exploitation requires an authenticated account with the license checkout permission on the target Snipe-IT instance. The attacker sends a request to the legacy single-seat license checkin URL for a seat assigned to another principal. The server returns the checkin view and permits the seat to be released. No user interaction from the victim is required.

php

     {
         // Check if the asset exists
         $license = License::find($licenseSeat->license_id);
-        $this->authorize('checkout', $license);
+        $this->authorize('checkin', $license);
 
         return view('licenses/checkin', compact('licenseSeat'))->with('backto', $backTo);
     }

Source: Snipe-IT patch commit 80c8aa41

The patch replaces the checkout authorization call with the correct checkin authorization call, enforcing the intended permission separation.

Detection Methods for CVE-2026-55479

Indicators of Compromise

Unexpected HTTP requests to the legacy licenses/{licenseSeat}/checkin route from accounts that lack the checkin permission.
License seats transitioning from assigned to available state without a corresponding administrative action.
Snipe-IT activity log entries showing checkin events initiated by users configured with checkout-only roles.
Sudden clusters of license reassignments preceded by seat releases from non-privileged users.

Detection Strategies

Review the Snipe-IT action_logs table for checkin from entries and correlate the acting user's role to verify they hold the licenses.checkin ability.
Enable web server access logging and alert on GET or POST requests to legacy license checkin endpoints performed by non-admin sessions.
Compare license seat assignment history against ticketing or change management records to identify unauthorized reclaims.

Monitoring Recommendations

Ship Snipe-IT application and web server logs to a centralized log platform and build detections for checkin actions performed by users without the checkin role.
Monitor for the deprecated legacy single-seat URL patterns and flag any traffic after upgrading to 8.6.2.
Track license seat state transitions and alert on high-volume or off-hours checkin activity by a single user.

How to Mitigate CVE-2026-55479

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which contains the corrected authorization check.
Audit user roles and remove the licenses.checkout permission from accounts that should not release seats until the upgrade is complete.
Review recent license checkin events in the activity log and restore any seats that were reclaimed without authorization.
Restrict network access to the Snipe-IT administrative interface to trusted networks or VPN users.

Patch Information

The fix is included in Snipe-IT v8.6.2. The relevant change is in app/Http/Controllers/Licenses/LicenseCheckinController.php, where the policy check was corrected from checkout to checkin. See the GitHub Security Advisory GHSA-8frh-vhgh-64cf and the Snipe-IT v8.6.2 release notes for full details.

Workarounds

If immediate upgrade is not possible, revoke the licenses.checkout permission from any user who should not be able to release seats.
Apply the upstream patch from commit 80c8aa41 to the local LicenseCheckinController.php file and clear the application cache.
Place the Snipe-IT application behind a reverse proxy that restricts access to legacy license checkin routes for non-administrative accounts.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear