The vulnerability stems from an incorrect authorization check in the legacy single‑seat license check‑in API of Snipe‑IT. The system authorizes the operation using the assign‑license permission instead of the intended check‑in permission, enabling a user who can grant licenses but normally cannot unassign to another user or asset. This allows an unauthorized transfer of license ownership and bypasses audit trails. The weakness is a classic example of improper privilege escalation (CWE‑863).

Snipe‑IT asset and license management from grokability is affected. Any installation running a version earlier than v8.6.2 is vulnerable, regardless of operating system or deployment method.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would typically use the legacy API endpoint, which requires network access to the Snipe‑IT instance and authentication as a user with assign‑license permissions. While network segmentation can reduce exposure, the risk of an insider user or compromised internal account remains, especially if that account holds the assign‑license role.