{"vulnerability": "CVE-2026-55843", "sightings": [{"uuid": "ff3c17e7-6d29-45a7-81d1-f9feca4f6b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mubu2orz3x2g", "content": "Top 3 CVE for last 7 days:\nCVE-2026-41992: 43 interactions\nCVE-2026-73570: 20 interactions\nCVE-2026-60004: 19 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-53362: 3 interactions\nCVE-2026-47876: 2 interactions\nCVE-2026-55843: 2 interactions\n", "creation_timestamp": "2026-08-30T07:19:26.633884Z"}, {"uuid": "1c39ea31-72e4-4b1a-8b1d-265197695322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcx6o6zfz2g", "content": "CVE-2026-55843 - Snipe-IT: Improper Privilege Management\nCVE ID : CVE-2026-55843\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission r...", "creation_timestamp": "2026-07-10T20:07:12.650885Z"}, {"uuid": "1809ea19-453e-43d3-9293-0974c35638dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhmz3k6w2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55843 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/17334C4D-D339-4D7E-8D7B-017CFBE1D8A9", "creation_timestamp": "2026-07-11T01:01:34.081476Z"}, {"uuid": "83fe3cba-5916-4778-afa3-9c38566ea381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://gist.github.com/alon710/bca69671d982aa5325684eebc9b91ff4", "content": "# CVE-2026-55843: CVE-2026-55843: Privilege Demotion and Access Control Bypass via Parameter Omission in Snipe-IT\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55843\n\n## Summary\nA comprehensive technical analysis of CVE-2026-55843, an Improper Privilege Management vulnerability (CWE-269) in Snipe-IT versions prior to 8.6.0. The vulnerability allows an authenticated editor or administrator to overwrite and strip the granular or administrative permissions of other users by omitting the permission parameter from profile update payloads. This issue has been resolved in Snipe-IT version 8.6.0.\n\n## TL;DR\nIn Snipe-IT prior to 8.6.0, submitting a user update request without the 'permission' field causes the application to normalize the missing value to an empty array and overwrite the target user's existing permissions, leading to complete privilege demotion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-269\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.0 (High)\n- **EPSS Score**: 0.00540 (Percentile: 43.02%)\n- **Impact**: Privilege Demotion / Integrity & Availability Loss\n- **Exploit Status**: PoC / Integration Tests Public\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Snipe-IT prior to version 8.6.0\n- **Snipe-IT**: < 8.6.0 (Fixed in: `8.6.0`)\n\n## Mitigation\n\n- Upgrade to Snipe-IT version 8.6.0 or newer.\n- Verify API integration scripts to ensure that partial user updates explicitly include or completely avoid touching permission properties.\n- Monitor audit logs for unexpected privilege demotions or empty permission objects.\n\n**Remediation Steps:**\n1. Identify current Snipe-IT version and plan downtime for upgrade.\n2. Apply the update to version 8.6.0 or later using standard Git or composer update processes.\n3. Validate existing user permissions in the database to ensure no previous administrative accounts were inadvertently stripped.\n4. Run integration tests or manual verification checks on user profile update paths.\n\n## References\n\n- [GitHub Fix Commit](https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad)\n- [GitHub Security Advisory](https://github.com/grokability/snipe-it/security/advisories/GHSA-j5g3-42wp-gqm3)\n- [Snipe-IT v8.6.0 Release Notes](https://github.com/grokability/snipe-it/releases/tag/v8.6.0)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-55843)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55843)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T06:33:12.683164Z"}, {"uuid": "cc1ce112-832f-44cc-bf60-1f0b2aec2b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu6pxq7gov2v", "content": "Snipe-IT CVE-2026-55843: UsersController::update passes the permission field through unconditionally, and it normalises to an empty array when absent. Only the superuser and admin keys are conditionally restored, so other permissions go with an update that never named them. #dev", "creation_timestamp": "2026-08-29T01:28:38.141984Z"}]}