CVE-2026-55483

Summary

Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation

Severity

medium

EPSS

0.3% (p23)

CWE

CWE-862

Also known as

GHSA-hf68-g98v-wp9g

Published

2026-06-23

Updated

2026-06-23

Advisory details

Impact

The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.

The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.

Patches

Patched in aea3877718

References

• https://github.com/advisories/GHSA-hf68-g98v-wp9g
• https://github.com/grokability/snipe-it/security/advisories/GHSA-hf68-g98v-wp9g
• https://github.com/grokability/snipe-it/commit/aea3877718158cc2a10c2dde4597b1f439f5f6cb

Related advisories

• CVE-2026-55476 — medium · Packagist/snipe/snipe-it
• CVE-2026-55703 — medium · Packagist/snipe/snipe-it
• CVE-2026-50550 — medium · Packagist/snipe/snipe-it
• CVE-2026-49976 — medium · Packagist/snipe/snipe-it
• CVE-2026-48492 — medium · Packagist/snipe/snipe-it
• CVE-2026-37709 — critical · Packagist/snipe/snipe-it
• CVE-2026-55843 — high · Packagist/snipe/snipe-it
• CVE-2026-55516 — high · Packagist/snipe/snipe-it

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity