MEDIUM5.7

GHSA-5wx7-xq8j-v4qm

Snipe-IT's import created_by can be overwritten

Quick fix

GHSA-5wx7-xq8j-v4qm — snipe/snipe-it: upgrade to the fixed version with the command below.

composer require snipe/snipe-it:^8.6.1

Details

### Impact The `created_by` of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/snipe/snipe-it

Introduced in: 0Fixed in: 8.6.1

Fixcomposer require snipe/snipe-it:^8.6.1

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-5wx7-xq8j-v4qm[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-55475[ADVISORY]
https://github.com/grokability/snipe-it/pull/19072[WEB]
https://github.com/grokability/snipe-it/commit/39fbe983132feca2ef15c1c0200fcc77c23a1434[WEB]
https://github.com/grokability/snipe-it[PACKAGE]
https://github.com/grokability/snipe-it/releases/tag/v8.6.1[WEB]