Grokability Snipe-It vulnerabilities

CVE-2026-85617 [HIGH] CWE-639 CVE-2026-85617: snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete func snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.

CVE-2026-86762 [HIGH] CWE-862 CVE-2026-86762: Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware gro Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant

CVE-2026-44832 [HIGH] CWE-281 CVE-2026-44832: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permiss

CVE-2026-86770 [HIGH] CWE-178 CVE-2026-86770: Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowi Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeove

CVE-2026-85616 [HIGH] CWE-639 CVE-2026-85616: Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a

CVE-2026-86751 [HIGH] CWE-73 CVE-2026-86751: Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-e

CVE-2026-86750 [HIGH] CWE-863 CVE-2026-86750: Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested company_id / company_ids[] values are filtered against the actor's permitted companies (Co

CVE-2026-86741 [HIGH] CWE-73 CVE-2026-86741: Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, e

CVE-2026-86733 [HIGH] CWE-78 CVE-2026-86733: Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/ Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin

CVE-2026-86738 [HIGH] CWE-79 CVE-2026-86738: Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, e

CVE-2026-54329 [HIGH] CWE-862 CVE-2026-54329: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. Thi

CVE-2026-55516 [HIGH] CWE-639 CVE-2026-55516: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an as

CVE-2026-55466 [HIGH] CWE-79 CVE-2026-55466: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin an

CVE-2026-55643 [HIGH] CWE-863 CVE-2026-55643: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS flo Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licens

CVE-2026-86771 [HIGH] CWE-918 CVE-2026-86771: Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal

CVE-2026-86754 [HIGH] CWE-863 CVE-2026-86754: Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions la

CVE-2026-55474 [MEDIUM] CWE-23 CVE-2026-55474: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue

CVE-2026-55452 [HIGH] CWE-1236 CVE-2026-55452: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report

CVE-2026-86759 [HIGH] CWE-862 CVE-2026-86759: Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

CVE-2026-55469 [MEDIUM] CWE-22 CVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.