Skip to content
Threat Feed
Subscribe
high advisory

Broken Access Control in Snipe-IT Asset Maintenance API

An authenticated user in a multi-company Snipe-IT deployment can exploit an authorization flaw in the asset maintenance update API to re-parent records to assets owned by other companies, breaking tenant isolation.

CVE search metadata

CVE search record: CVE-2026-55516. Severity: high. CVSS: 7.7. EPSS: 0.38%. KEV: no. Product: Snipe-IT (<= 8.6.1), Snipe-IT (< 8.5.0). Brief: Broken Access Control in Snipe-IT Asset Maintenance API. Brief link: https://feed.craftedsignal.io/briefs/2026-08-snipe-it-auth-bypass/

What's new

  • 1. added detection rule: Detect CVE-2026-55460 Exploitation - Unauthorized Bulk User Deletion Aug 28, 21:18 via ghsa
  • 2. added detection rule: Detects CVE-2026-55474 Exploitation - Path Traversal in displaySig Aug 28, 21:18 via ghsa

Snipe-IT version 8.6.1 and earlier is vulnerable to a broken access control flaw identified as CVE-2026-55516. The vulnerability exists within the API endpoints used to update maintenance records, specifically PATCH /api/v1/maintenances/{maintenance_id} and PUT /api/v1/maintenances/{maintenance_id}.

In a multi-company environment where strict tenant isolation is expected, the application correctly validates access to the existing maintenance record and its associated asset during the update process. However, it fails to perform secondary authorization checks on the newly supplied asset_id provided in the request body. This allows an authenticated user with maintenance modification permissions to re-parent a maintenance record to an asset belonging to a different company to which they should not have access. This flaw compromises the integrity of asset lifecycle records and enables unauthorized cross-company modification.

Attack Chain

  1. Attacker authenticates to the Snipe-IT web application using a legitimate API token with maintenance management permissions.
  2. Attacker retrieves or identifies a maintenance_id currently associated with an asset within their authorized company scope.
  3. Attacker identifies the asset_id of a victim asset belonging to a different company (the target).
  4. Attacker constructs a PATCH or PUT request to /api/v1/maintenances/{maintenance_id}.
  5. Attacker includes the target asset_id in the request body JSON payload.
  6. The MaintenancesController validates access to the initial asset but fails to validate the new asset_id against the user's company scope.
  7. The application executes $maintenance->save(), committing the unauthorized association to the database.
  8. The victim company's asset records are now polluted with the attacker-controlled maintenance entry.

Impact

The vulnerability results in a loss of data integrity for multi-company deployments by bypassing tenant isolation. Attackers can pollute asset history across company boundaries, leading to incorrect warranty, audit, and maintenance tracking. This may also be used to obfuscate asset history or generate fraudulent maintenance records for assets owned by other entities within the same Snipe-IT instance.

Recommendation

  1. Upgrade to a version of Snipe-IT that resolves CVE-2026-55516.
  2. Review application logs for API calls to MaintenancesController originating from low-privilege accounts that involve asset_id changes to determine if cross-company record movement has occurred.
  3. If immediate patching is not possible, restrict API access for non-administrative accounts until a fix is deployed.

Immediate actions

Upgrade Snipe-IT to 8.6.2 or later

IT Operations 48h

Mitigations

Monitor API access logs for anomalous PATCH/PUT requests to maintenance endpoints.

immediate SOC

CVE-2026-55516

Detection coverage 2

Detects CVE-2026-55474 Exploitation - Path Traversal in displaySig

high

Detects HTTP requests to the displaySig endpoint containing directory traversal patterns in the filename parameter.

sigma tactics: initial_access techniques: T1083 sources: webserver

Detect CVE-2026-55460 Exploitation - Unauthorized Bulk User Deletion

high

Detects unauthorized attempts to invoke the bulk user deletion functionality by non-privileged users via the /users/bulksave endpoint.

sigma tactics: privilege-escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →