PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55516 Snipeitapp CVE debrief

CVE-2026-55516 is a HIGH severity vulnerability in Snipe-IT, an IT asset/license management system. Prior to version 8.6.2, an authorized user can manipulate a maintenance record to reference an asset outside their company scope. The vulnerability exists because the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint checks access to the current maintenance record and asset but then fills attacker-controlled fields, including asset_id, without re-authorizing the newly supplied asset. The issue is fixed in version 8.6.2.

Vendor
Snipeitapp
Product
Snipe-It
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-10
Original CVE updated
2026-07-10
Advisory published
2026-07-10
Advisory updated
2026-07-10

Who should care

Administrators and users of Snipe-IT versions prior to 8.6.2 should apply the patch to prevent unauthorized maintenance record manipulation. This vulnerability may impact organizations that use Snipe-IT for IT asset/license management, particularly those with multiple companies or scopes. Security teams should review the official advisory and apply the patch as soon as possible.

Technical summary

The vulnerability is caused by insufficient authorization checks in the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint of Snipe-IT, an IT asset/license management system. An authorized user can exploit this vulnerability to move a maintenance record onto an asset outside their company scope. The issue is fixed in version 8.6.2. The vulnerability has a HIGH severity and a CVSS score of 7.7.

Defensive priority

Apply the patch to prevent unauthorized maintenance record manipulation. This vulnerability has a HIGH severity and a CVSS score of 7.7, indicating a significant risk to organizations that use Snipe-IT.

Recommended defensive actions

  • Apply the patch to upgrade Snipe-IT to version 8.6.2 or later
  • Restrict access to the PATCH or PUT /api/v1/maintenances/{maintenance_id} endpoint
  • Monitor maintenance record changes for suspicious activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-10T19:17:25.710Z and has not been modified since then. The NVD entry is currently Analyzed. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in Snipe-IT versions prior to 8.6.2, and administrators should review the official advisory for mitigation guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55516 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55516

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55516 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55516

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.