CVE-2026-55483 is a high severity (CVSS 8.8) missing authorization flaw in Snipe-IT. A user with the users.create permission can submit the admin permission when creating an account, and the new account gets administrative privileges. Upgrade to a current release. The steps below show how to check your version and what to change.
What's affected
Versions differ between sources. The record says versions before 8.6.0 are affected and 8.6.0 contains the fix, and it scores the issue 8.8 (High). The GitHub advisory lists 8.4.1 and earlier as affected, 8.4.2 as patched, and rates the issue Moderate.
If you are on 8.4.1 or earlier, you are affected by either reading. If you are on a version between 8.4.2 and 8.5.x, the sources disagree, so upgrade to a current release rather than relying on either boundary. A release at or above 8.6.0 satisfies both.
The attacker needs a login with the users.create permission, which the advisory says is often delegated to HR staff or department leads.
How to check if you're exposed
Open the Snipe-IT admin interface and read the version in the page footer. For Docker installs, check the image tag you pulled.
Then list who holds the users.create permission and which accounts have admin rights. Look for admin accounts you do not recognise and check their creation dates and who created them in the activity log.
What to do now
- Upgrade to a current Snipe-IT release, at least 8.6.0, which satisfies both the record and the advisory.
- Review all administrator accounts and remove any you cannot account for.
- Review who has the users.create permission and remove it where it is not needed.
- Check the activity log for user creations by non-superusers.
Why it matters
The record lists CWE-862, missing authorization. The user store routine removes the superuser permission when a non-superuser creates an account, but it did not remove the admin permission. A user allowed to create accounts could therefore create one that was more powerful than themselves.
That is a classic privilege escalation by delegation. Permissions that look narrow, like creating users, need guardrails on what they may grant. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the sources list different versions?
The record says before 8.6.0 and the advisory says 8.4.1 and earlier with 8.4.2 patched. Upgrading to 8.6.0 or later satisfies both.
Who can exploit this?
A logged-in user who has the users.create permission, per the advisory.
Sources
Last reviewed: 18 October 2026.
