CVE-2026-55472 is an incorrect authorization vulnerability (CWE-863) in the Snipe-IT IT asset/license management system. Specifically, in versions before 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint improperly handles parent-child company mismatches. Although it detects the mismatch, it does not immediately return an error, permitting the creation of a child location under a parent location belonging to a different company. This behavior violates intended authorization boundaries. The vulnerability is resolved in Snipe-IT version 8.6.2.

The vulnerability allows an authenticated user with some privileges (low privileges required) to create a child location under a parent location from a different company, which could lead to unauthorized data association or confusion in asset management. The confidentiality impact is low, with no integrity or availability impacts reported. There are no known exploits in the wild.

Upgrade Snipe-IT to version 8.6.2 or later, where this authorization issue is fixed. Since no official patch link or vendor advisory is provided, confirm the upgrade path with the vendor or official Snipe-IT release notes. Patch status is not yet confirmed via vendor advisory; check official sources for current remediation guidance.