GHSA-CRV3-J83J-F3R6 Snipe-IT has missing object-level authorization in Kits API

Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...

Snipe-IT has missing object-level authorization in Kits API

Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...

CVE-2026-55478

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

PT-2026-57269

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2 Description An authorization flaw exists in the IT asset and license management system. The endpoint "/api/v1/kits/kit id/licenses" verifies if the user has permissions to edit kits but fails to authorize acces...