CVE-2026-55516 is an authorization bypass vulnerability in grokability's Snipe-IT IT asset/license management system. Before version 8.6.2, the PATCH or PUT request to /api/v1/maintenances/{maintenance_id} verifies access to the existing maintenance record and associated asset but does not re-validate authorization for a newly supplied asset_id field controlled by the user. This flaw allows an authorized user to reassign a maintenance record to an asset outside their permitted company scope, violating access control policies. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 score of 7.7 (High). The issue is resolved in version 8.6.2.

An authorized user can exploit this vulnerability to move maintenance records onto assets outside their authorized company scope, potentially leading to unauthorized modification or reassignment of asset maintenance data. This impacts the integrity of asset management records but does not affect confidentiality or availability according to the CVSS vector.

Upgrade Snipe-IT to version 8.6.2 or later, where this authorization bypass vulnerability is fixed. No official patch or temporary workaround is documented, so applying the official fix is required to remediate the issue.