Grokability Snipe-It vulnerabilities

CVE-2026-86771 [HIGH] CWE-918 CVE-2026-86771: Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal

CVE-2026-86759 [HIGH] CWE-862 CVE-2026-86759: Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

CVE-2026-55474 [MEDIUM] CWE-23 CVE-2026-55474: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue

CVE-2026-62368 [HIGH] CWE-79 CVE-2026-62368: Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.crea Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes

CVE-2026-86774 [MEDIUM] CWE-284 CVE-2026-86774: Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy whe Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate

CVE-2026-50550 [MEDIUM] CWE-863 CVE-2026-50550: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_

CVE-2026-55469 [MEDIUM] CWE-22 CVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVE-2026-55460 [HIGH] CWE-863 CVE-2026-55460: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in

CVE-2026-86758 [MEDIUM] CWE-204 CVE-2026-86758: Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and AP Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the

CVE-2026-48492 [MEDIUM] CWE-862 CVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/ Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions ar

CVE-2026-86746 [MEDIUM] CWE-269 CVE-2026-86746: Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enf Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, inclu

CVE-2026-49870 [MEDIUM] CWE-770 CVE-2026-49870: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limi Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When t

CVE-2026-48507 [HIGH] CWE-863 CVE-2026-48507: Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not th

CVE-2026-55843 [MEDIUM] CWE-269 CVE-2026-55843: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another ad

CVE-2026-49976 [MEDIUM] CWE-863 CVE-2026-49976: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activ

CVE-2026-86765 [MEDIUM] CWE-862 CVE-2026-86765: Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are sub Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned

CVE-2026-86764 [MEDIUM] CWE-862 CVE-2026-86764: Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authe Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view fla

CVE-2026-55694 [MEDIUM] CWE-639 CVE-2026-55694: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /ap Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Control

CVE-2026-86757 [MEDIUM] CWE-862 CVE-2026-86757: Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form t Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset

CVE-2026-86739 [MEDIUM] CWE-252 CVE-2026-86739: Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signatur Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a