CyberRota Analysis
AI-GeneratedThe vulnerability affects Snipe-IT versions prior to 8.6.2, where the legacy single-seat license check-in process incorrectly authorizes actions using checkout permissions instead of check-in permissions. This flaw allows users with license assignment capabilities to reclaim licenses from other users or assets without proper authorization. Organizations using Snipe-IT for asset management should prioritize upgrading to version 8.6.2 to mitigate the risk of unauthorized license reclamation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)