What is GHSA-5wx7-xq8j-v4qm?

GHSA-5wx7-xq8j-v4qm is a security advisory published by GitHub Security Advisories with Medium severity. Snipe-IT's import created_by can be overwritten

Which CVE IDs does GHSA-5wx7-xq8j-v4qm cover?

GHSA-5wx7-xq8j-v4qm covers the following CVE IDs: CVE-2026-55475. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5wx7-xq8j-v4qm?

GHSA-5wx7-xq8j-v4qm has a CVSS v3 base score of 5.7, published by GitHub Security Advisories.

Which products are affected by GHSA-5wx7-xq8j-v4qm?

GHSA-5wx7-xq8j-v4qm affects 1 product, including: composer/snipe/snipe-it:\u003c= 8.6.0.

GHSA-5wx7-xq8j-v4qmMediumCVSS 5.7

Snipe-IT's import created_by can be overwritten

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-55475 →

📋 Description

Impact

The created_by of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.

🎯 Affected products1

composer/snipe/snipe-it:<= 8.6.0

🔗 References (6)

https://github.com/grokability/snipe-it/security/advisories/GHSA-5wx7-xq8j-v4qm
https://nvd.nist.gov/vuln/detail/CVE-2026-55475
https://github.com/grokability/snipe-it/pull/19072
https://github.com/grokability/snipe-it/commit/39fbe983132feca2ef15c1c0200fcc77c23a1434
https://github.com/grokability/snipe-it/releases/tag/v8.6.1
https://github.com/advisories/GHSA-5wx7-xq8j-v4qm