CVE-2026-55479: Snipe-IT has incorrect permission for legacy license checkin API

August 28, 2026

The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat that is currently assigned to another user or asset.

References

github.com/advisories/GHSA-8frh-vhgh-64cf
github.com/grokability/snipe-it/commit/80c8aa41dc813b0815db00bb44eb0fff9f89a227
github.com/grokability/snipe-it/releases/tag/v8.6.2
github.com/grokability/snipe-it/security/advisories/GHSA-8frh-vhgh-64cf
nvd.nist.gov/vuln/detail/CVE-2026-55479

Code Behaviors & Features

Detect and mitigate CVE-2026-55479 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →