CVE-2026-55483
MediumCVSS 4.9Summary
Snipe-IT prior to 8.6.0 allows an authenticated user with users.create permission to assign admin permission when creating a user. The store() method strips superuser but not admin permission, allowing the created account to gain administrative privileges.
Risk Assessment
The risk includes privilege escalation, where a regular user can create an admin account, potentially leading to full system compromise.
Recommendation
Update to version 8.6.0 or later and ensure admin permissions are properly controlled during user creation.
Original NVD description (English source)
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.