Grokability Snipe-It vulnerabilities

CVE-2026-86774 [MEDIUM] CWE-284 CVE-2026-86774: Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy whe Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate

CVE-2026-55460 [HIGH] CWE-863 CVE-2026-55460: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in

CVE-2026-55694 [HIGH] CWE-639 CVE-2026-55694: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /ap Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controlle

CVE-2026-48492 [MEDIUM] CWE-862 CVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/ Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions ar

CVE-2026-86758 [MEDIUM] CWE-204 CVE-2026-86758: Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and AP Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the

CVE-2026-86746 [MEDIUM] CWE-269 CVE-2026-86746: Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enf Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, inclu

CVE-2026-49870 [MEDIUM] CWE-770 CVE-2026-49870: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limi Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When t

CVE-2026-48507 [HIGH] CWE-863 CVE-2026-48507: Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not th

CVE-2026-55843 [MEDIUM] CWE-269 CVE-2026-55843: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another ad

CVE-2026-49976 [MEDIUM] CWE-863 CVE-2026-49976: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activ

CVE-2026-86765 [MEDIUM] CWE-862 CVE-2026-86765: Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are sub Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned

CVE-2026-86764 [MEDIUM] CWE-862 CVE-2026-86764: Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authe Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view fla

CVE-2026-86766 [MEDIUM] CWE-362 CVE-2026-86766: Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable chec Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without lock

CVE-2026-86757 [MEDIUM] CWE-862 CVE-2026-86757: Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form t Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset

CVE-2026-86749 [MEDIUM] CWE-252 CVE-2026-86749: Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operation Snipe-IT versions put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where

CVE-2026-55482 [MEDIUM] CWE-639 CVE-2026-55482: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1

CVE-2026-86755 [MEDIUM] CWE-863 CVE-2026-86755: Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-toke Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). An

CVE-2026-86742 [MEDIUM] CWE-1236 CVE-2026-86742: Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance re Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config(

CVE-2026-61807 [MEDIUM] CWE-79 CVE-2026-61807: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML st

CVE-2026-86745 [MEDIUM] CWE-1236 CVE-2026-86745: Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the co Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Cs