CVE-2026-55475: Snipe-IT's import created_by can be overwritten
The created_by of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.
References
- github.com/advisories/GHSA-5wx7-xq8j-v4qm
- github.com/grokability/snipe-it/commit/39fbe983132feca2ef15c1c0200fcc77c23a1434
- github.com/grokability/snipe-it/pull/19072
- github.com/grokability/snipe-it/releases/tag/v8.6.1
- github.com/grokability/snipe-it/security/advisories/GHSA-5wx7-xq8j-v4qm
- nvd.nist.gov/vuln/detail/CVE-2026-55475
Code Behaviors & Features
Detect and mitigate CVE-2026-55475 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →