CVE-2026-55843 Details

A vulnerability exists in Snipe-IT versions prior to 8.6.0, specifically within the UsersController's update method. The issue arises because the method passes a missing permission request field through two actions in a way that can unintentionally overwrite a user's permissions. This allows an administrator to update another administrator's account, or a user with the 'users.edit' permission to update a regular account, and remove critical permissions such as administrative rights or specific granular permissions. The vulnerability is rooted in improper handling of permission fields during user updates, which can lead to significant unintentional changes in user roles and capabilities.

Users are advised to upgrade to Snipe-IT version 8.6.0 or later, where this vulnerability has been addressed.