{"uuid": "cc1ce112-832f-44cc-bf60-1f0b2aec2b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55843", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu6pxq7gov2v", "content": "Snipe-IT CVE-2026-55843: UsersController::update passes the permission field through unconditionally, and it normalises to an empty array when absent. Only the superuser and admin keys are conditionally restored, so other permissions go with an update that never named them. #dev", "creation_timestamp": "2026-08-29T01:28:38.141984Z"}