CVE-2026-55460 is an incorrect authorization vulnerability in the Snipe-IT IT asset/license management system before version 8.6.2. An authenticated user lacking delete permissions but having view and edit permissions can exploit this flaw by posting to the /users/bulksave endpoint with delete_user=1, triggering the BulkUsersController::destroy() method which authorizes only update permissions. This allows the attacker to soft-delete other non-admin users without proper authorization. The vulnerability is resolved in Snipe-IT version 8.6.2.

The vulnerability allows an authenticated non-admin user to soft-delete other non-admin user accounts without having explicit delete permissions. This can lead to unauthorized modification of user data and potential disruption of user access within the system. There is no indication of confidentiality or integrity impact beyond the unauthorized deletion, and no known exploits in the wild have been reported.

Upgrade Snipe-IT to version 8.6.2 or later, where this authorization flaw has been fixed. Since the vendor advisory does not provide a specific patch link or temporary workaround, applying the official update is the recommended remediation. Patch status is confirmed by the vendor stating the issue is fixed in 8.6.2.