CVE-2026-55516 is an authorization bypass vulnerability in grokability's Snipe-IT asset management system affecting versions before 8.6.2. The vulnerability arises because the PATCH or PUT API endpoint for maintenance records verifies access only for the original maintenance record and asset but does not re-validate authorization when the asset_id field is changed by the user. This flaw enables an authorized user to associate a maintenance record with an asset outside their authorized company scope, violating access controls. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with authorized access to the maintenance record API can reassign maintenance records to assets outside their permitted company scope, potentially leading to unauthorized modification or mismanagement of assets. This impacts the integrity of asset management data but does not directly affect confidentiality or availability. The CVSS 3.1 base score is 7.7 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high impact on integrity.

A fix is available in Snipe-IT version 8.6.2. Users should upgrade to version 8.6.2 or later to remediate this vulnerability. No official vendor advisory content was provided, but the description explicitly states the issue is fixed in 8.6.2. Until upgrading, restrict access to the affected API endpoints to trusted users only.