Authorization Bypass in Snipe-IT Kit License Binding

Executive Summary

The vulnerability CVE-2026-55478 is an object-level authorization flaw in the Snipe-IT asset management system, specifically in the Kits API endpoint POST /api/v1/kits/{kit_id}/licenses.

While the API checks if a user has permission to edit kits, it does not verify whether the user has permission to access or manage the specific license being added to a kit.

This allows a low-privilege user with only predefined-kit permissions to bind a license they should not be able to access or manage into a kit.

The issue was fixed in version 8.6.2 by adding proper authorization checks to ensure users have both kit edit and license view permissions before associating licenses with kits.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users with limited permissions to associate licenses with kits that they should not have access to.

Such unauthorized modifications could lead to incorrect asset or license management, potentially causing confusion, misallocation of resources, or unauthorized use of licenses.

It may also undermine the integrity of the asset management system by allowing low-privilege users to make changes beyond their intended scope.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a missing object-level authorization check in the Snipe-IT Kits API endpoint POST /api/v1/kits/{kit_id}/licenses, allowing low-privilege users to bind licenses they should not access.

To detect exploitation attempts on your system, you can monitor API calls to the endpoint POST /api/v1/kits/{kit_id}/licenses for unusual activity from users with only predefined-kit permissions.

Specifically, you can audit logs for POST requests to this endpoint where the user does not have full license management permissions but is able to add licenses to kits.

Commands to help detect this might include searching your web server or application logs for such POST requests, for example using grep or similar tools:

• grep 'POST /api/v1/kits/' /path/to/snipe-it/logs/access.log | grep '/licenses'
• Analyze the user roles associated with these requests to identify if low-privilege users are performing license bindings.

Additionally, you can use API monitoring or intrusion detection systems to alert on POST requests to this endpoint from users lacking proper license permissions.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade your Snipe-IT installation to version 8.6.2 or later, where this vulnerability has been fixed.

The fix involves proper authorization checks ensuring that users must have both kit edit permissions and view permissions on the specific license before associating it with a kit.

If upgrading immediately is not possible, consider restricting access to the POST /api/v1/kits/{kit_id}/licenses endpoint to only trusted users with full permissions.

Review and tighten user roles and permissions to ensure that low-privilege users cannot perform license bindings.

Monitor logs for suspicious activity as a temporary measure until the patch can be applied.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a low-privilege user to associate licenses they should not have access to with predefined kits due to missing object-level authorization checks. This unauthorized access and modification could lead to improper handling of asset/license data.

Such unauthorized access and potential data exposure or modification may impact compliance with standards and regulations like GDPR or HIPAA, which require strict access controls and protection of sensitive data.

However, the provided information does not explicitly state the direct impact on compliance frameworks.

Useful 0 Not Useful 0