PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55516 Snipeitapp CVE debrief

CVE-2026-55516 is a HIGH severity vulnerability in Snipe-IT, an IT asset/license management system. Prior to version 8.6.2, an authorized user can manipulate a maintenance record to reference an asset outside their company scope. The vulnerability exists because the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint checks access to the current maintenance record and asset but then fills attacker-controlled fields, including asset_id, without re-authorizing the newly supplied asset. The issue is fixed in version 8.6.2.

Vendor
Snipeitapp
Product
Snipe-It
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-10
Original CVE updated
2026-07-10
Advisory published
2026-07-10
Advisory updated
2026-07-10

Who should care

Administrators and users of Snipe-IT versions prior to 8.6.2 should apply the patch to prevent unauthorized maintenance record manipulation. This vulnerability may impact organizations that use Snipe-IT for IT asset/license management, particularly those with multiple companies or scopes. Security teams should review the official advisory and apply the patch as soon as possible.

Technical summary

The vulnerability is caused by insufficient authorization checks in the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint of Snipe-IT, an IT asset/license management system. An authorized user can exploit this vulnerability to move a maintenance record onto an asset outside their company scope. The issue is fixed in version 8.6.2. The vulnerability has a HIGH severity and a CVSS score of 7.7.

Defensive priority

Apply the patch to prevent unauthorized maintenance record manipulation. This vulnerability has a HIGH severity and a CVSS score of 7.7, indicating a significant risk to organizations that use Snipe-IT.

Recommended defensive actions

  • Apply the patch to upgrade Snipe-IT to version 8.6.2 or later
  • Restrict access to the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint
  • Monitor maintenance record changes for suspicious activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-10T19:17:25.710Z and has not been modified since then. The NVD entry is currently Analyzed. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in Snipe-IT versions prior to 8.6.2, and administrators should review the official advisory for mitigation guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-10T19:17:25.710Z and has not been modified since then.