CVE-2026-55479: 
NixOS vulnerability analysis and mitigation

CVE-2026-55479 is an incorrect authorization vulnerability in Snipe-IT, an open-source IT asset and license management system. The flaw exists in the legacy single-seat license checkin flow, which incorrectly authorizes the checkin action using the checkout permission instead of the checkin permission. All versions prior to 8.6.2 are affected. The vulnerability was published on July 10, 2026, and patched in version 8.6.2 released June 13, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an incorrect authorization check (CWE-863) in app/Http/Controllers/Licenses/LicenseCheckinController.php. Both the create and store methods of the legacy LicenseCheckinController called $this->authorize('checkout', $license) instead of $this->authorize('checkin', $license), meaning the checkin action was gated on the wrong permission. An authenticated user with only the checkout (assign) permission — but explicitly lacking the checkin (unassign) permission — could directly access the legacy checkin endpoint and reclaim any license seat assigned to another user or asset. The fix, applied in commit 80c8aa4, replaces the two incorrect checkout authorization calls with the correct checkin permission check (GitHub Commit, GitHub Advisory).

An authenticated attacker with license checkout/assignment permissions can bypass the intended access control and reclaim license seats assigned to other users or assets without holding the checkin/unassignment permission. This results in an integrity impact — unauthorized modification of license assignment records — which could disrupt license tracking, cause compliance issues, and allow a low-privileged user to manipulate asset allocation across the organization. There is no confidentiality or availability impact, and the scope is limited to the Snipe-IT application itself (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires an authenticated account with at least the license checkout permission, limiting the attack surface to internal or trusted users. The EPSS score is approximately 0.0024 (0.24%), reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory).

1. Authenticate: Log in to the Snipe-IT instance with an account that has the license checkout (assign) permission but lacks the checkin (unassign) permission.
2. Identify target license seat: Browse or query the Snipe-IT interface to identify a license seat currently assigned to another user or asset that the attacker wishes to reclaim.
3. Access legacy checkin endpoint: Directly navigate to or send an HTTP GET request to the legacy single-seat license checkin endpoint (e.g., /licenses/{seatId}/checkin) — the endpoint that invokes the LicenseCheckinController@create method.
4. Submit checkin request: Submit the checkin form or send an HTTP POST request to the LicenseCheckinController@store method for the targeted seat ID. Because both methods incorrectly check the checkout permission (which the attacker holds), the authorization passes.
5. License seat reclaimed: The license seat is successfully checked in (unassigned from the original user/asset) without the attacker holding the proper checkin permission, altering license assignment records (GitHub Advisory, GitHub Commit).

• Logs: Snipe-IT application logs showing checkin actions performed by users who do not hold the checkin permission; audit log entries recording license seat checkins attributed to users with only checkout/assign roles.
• Application Audit Trail: Unexpected changes in license seat assignment history — seats being checked in by users who should not have that capability, particularly via the legacy checkin endpoint path.
• Network: HTTP GET or POST requests to legacy license checkin URLs (e.g., /licenses/*/checkin) originating from user accounts not expected to perform checkin operations.

Upgrade Snipe-IT to version 8.6.2 or later, which corrects the authorization check in the legacy LicenseCheckinController (GitHub Release). As a temporary workaround prior to patching, administrators should restrict the checkout permission only to users who are also authorized to perform checkins, effectively aligning the two permissions until the fix is applied. Additionally, monitoring access to the legacy checkin endpoint for unexpected activity can help detect potential abuse (GitHub Advisory).

The vulnerability was reported by security researcher Mitchell45 and disclosed via GitHub's security advisory program with a "Moderate" severity rating. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).