In short
- CVE-2026-55475 is a MEDIUM (CVSS 5.7) vulnerability affecting snipe/snipe-it, snipe-it (snipeitapp).
- Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 28.0% of all vulnerabilities.
- Fix: update to 8.6.1 or later.
Description
Impact
The created_by of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.
NVD description
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.
More vulnerabilities in snipe/snipe-it
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free