Is CVE-2026-50550 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50550 being exploited in the wild.

How severe is CVE-2026-50550?

Medium severity, with a CVSS score of 5.8, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) < 8.5.0, ECOSYSTEM:introduced=0,fixed=8.5.0.

Is there a fix for CVE-2026-50550?

Yes. snipe/snipe-it (Packagist): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50550 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-50550?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50550: Snipe-IT 2FA reset privilege bypass in user management

Q: Is there a fix for CVE-2026-50550?

Yes. snipe/snipe-it (Packagist): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50550 attacked?

It is attacked from the adjacent network, in a network appliance.

Q: Am I affected by CVE-2026-50550?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50550 · Severity: medium · CVSS 5.8 · Published 2026-08-19

Snipe-IT, a popular open-source asset management system, contains a security flaw that allows certain users to bypass two-factor authentication (2FA) protections. Specifically, a user with permissions to edit other profiles can reset the 2FA settings of a Superadmin. This could allow an attacker to weaken the security of the most powerful accounts in the system, potentially leading to full administrative takeover if they also possess the user's password.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-50550 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50550 being exploited in the wild.
How severe is CVE-2026-50550?: Medium severity, with a CVSS score of 5.8, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) < 8.5.0, ECOSYSTEM:introduced=0,fixed=8.5.0.
Is there a fix for CVE-2026-50550?: Yes. snipe/snipe-it (Packagist): upgrade to 8.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50550 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-50550?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.5.0 or later
```
composer require snipe/snipe-it:^8.5.0
```

Technical details

A missing authorization vulnerability (CWE-862) in Snipe-IT allows a user with the 'edit users' permission to reset the two-factor authentication (2FA) settings for Superadmin accounts. The root cause is an insufficient check on whether the actor has the authority to modify the security settings of a higher-privileged user. The attack requires low privileges and user interaction, and is restricted to the adjacent network according to the CVSS metrics. Successful exploitation allows an attacker to remove the 2FA requirement for a Superadmin, facilitating account takeover if credentials are known. This issue is resolved in version 8.5.0.

Affected products

Grokability Snipe-IT < 8.5.0

Identifiers

CVE-2026-50550
GHSA-6x4j-8954-5hxm

Timeline

2026-06-08: disclosed
2026-06-08: patched: Fixed in version 8.5.0
2026-06-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.