CVE-2026-55460: Snipe-IT has an authorization bypass on bulk editing users

August 28, 2026

An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update.

References

github.com/advisories/GHSA-vgx7-c78r-69w9
github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5
github.com/grokability/snipe-it/releases/tag/v8.6.2
github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9
nvd.nist.gov/vuln/detail/CVE-2026-55460

Code Behaviors & Features

Detect and mitigate CVE-2026-55460 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →