CVE-2026-55460 is an incorrect authorization vulnerability (CWE-863) in the Snipe-IT IT asset/license management system. Prior to version 8.6.2, an authenticated user lacking users.delete permission but having users.view and users.edit permissions can send a crafted POST request to /users/bulksave with delete_user=1. Due to improper authorization checks in BulkUsersController::destroy(), which only verifies update permissions, the user can soft-delete other non-admin users. This elevates the impact of the users.edit permission beyond intended limits. The vulnerability is resolved in Snipe-IT version 8.6.2.

An attacker with authenticated access and users.view and users.edit permissions but without users.delete permission can soft-delete other non-admin users. This results in unauthorized modification of user data (integrity impact) and partial denial of service (availability impact) for affected user accounts. There is no confidentiality impact reported. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

Upgrade Snipe-IT to version 8.6.2 or later where this authorization flaw is fixed. No other mitigations are documented. Patch status is not explicitly stated but the fix is confirmed in version 8.6.2.