Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-10 | 2 | Disclosure1General1 |
| 2026-07-13 | 1 | Disclosure1 |
| 2026-08-29 | 1 | General1 |
🟠 Snipe-IT, Improper Privilege Management, #CVE-2026-55843 (Medium) -DC-Aug2026-2033 https://dailycve.com/snipe-it-improper-privilege-management-cve-2026-55843-medium-dc-aug2026-2033/
Post summary
The text announces CVE‑2026‑55843 for Snipe‑IT, describing an improper privilege management vulnerability with medium severity, without further details on exploitation, PoC, or remediation.
🔴 Snipe-IT, Improper Privilege Management, #CVE-2026-55843 (High) -DC-Jul2026-878 https://dailycve.com/snipe-it-improper-privilege-management-cve-2026-55843-high-dc-jul2026-878/
Post summary
The tweet shares a link to a dailycve.com article announcing CVE‑2026‑55843 for Snipe‑IT, noting an improper privilege management flaw with high severity, but offers no further technical, exploit, or mitigation details.
🚨*CVE* CVE-2026-55843 Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPay… https://www.cve.org/CVERecord?id=CVE-2026-55843 ----- Traducción: CVE-2026-55843 Sni… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-55843 for Snipe-IT, noting a permissions handling flaw in the UsersController before version 8.6.0, but provides no PoC, exploit details, patch information, or evidence of active exploitation.
CVE-2026-55843 Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPay… https://www.cve.org/CVERecord?id=CVE-2026-55843
Post summary
This is a brief disclosure of a missing permission sanitization bug in Snipe-IT versions prior to 8.6.0, with a link to the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |