Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-10 | 2 | Disclosure2 |
| 2026-07-13 | 1 | Disclosure1 |
🔴 Snipe-IT Authorization Bypass, #CVE-2026-55460 (High) -DC-Jul2026-883 https://dailycve.com/snipe-it-authorization-bypass-cve-2026-55460-high-dc-jul2026-883/
Post summary
The post announces the identification of an authorization bypass vulnerability (CVE‑2026‑55460) in Snipe‑IT, noting its high severity.
🚨*CVE* CVE-2026-55460 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directl… https://www.cve.org/CVERecord?id=CVE-2026-55460 ----- Traducción: CVE-2026-55460 Sni… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑55460 for Snipe‑IT, noting a privilege‑escalation flaw affecting authenticated non‑admin users before version 8.6.2. No proof‑of‑concept, active exploitation, or patch information is provided.
CVE-2026-55460 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directl… https://www.cve.org/CVERecord?id=CVE-2026-55460
Post summary
CVE‑2026‑55460 is a privilege‑escalation flaw in Snipe‑IT prior to 8.6.2, allowing authenticated non‑admin users with view/edit rights to exploit a vulnerability; no PoC, exploit code, or active exploitation evidence is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |