Grokability Snipe-It vulnerabilities

CVE-2026-86734 [MEDIUM] CWE-400 CVE-2026-86734: Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{ac Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the m

CVE-2026-86760 [MEDIUM] CWE-863 CVE-2026-86760: Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in ap Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit

CVE-2026-86756 [MEDIUM] CWE-601 CVE-2026-86756: Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes

CVE-2026-55475 [MEDIUM] CWE-863 CVE-2026-55475: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.

CVE-2026-48493 [MEDIUM] CWE-863 CVE-2026-48493: Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only user Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.

CVE-2026-19579 [MEDIUM] CWE-639 CVE-2026-19579: Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the ass Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-emp

CVE-2026-86747 [MEDIUM] CWE-863 CVE-2026-86747: Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the re Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/sent_reminder (ReportsController::sentAssetAcceptanceReminder) and DELETE /reports/unaccepted_assets/{acceptanceId}/delete (ReportsController::deleteAssetAcceptance) are not correctly scoped wh

CVE-2026-50550 [MEDIUM] CWE-863 CVE-2026-50550: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_

CVE-2026-86768 [MEDIUM] CWE-20 CVE-2026-86768: Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authe Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references

CVE-2026-55478 [MEDIUM] CWE-639 CVE-2026-55478: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licens Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This iss

CVE-2026-55483 [MEDIUM] CWE-862 CVE-2026-55483: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users. Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative pr

CVE-2026-86748 [MEDIUM] CWE-460 CVE-2026-86748: Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in th Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

CVE-2026-86735 [MEDIUM] CWE-918 CVE-2026-86735: snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUr snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access interna

CVE-2026-55464 [MEDIUM] CWE-79 CVE-2026-55464: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but d Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and cli

CVE-2026-55519 [MEDIUM] CWE-285 CVE-2026-55519: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generi Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authoriz

CVE-2026-44833 [HIGH] CWE-601 CVE-2026-44833: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

CVE-2026-55461 [MEDIUM] CWE-601 CVE-2026-55461: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()-> Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate u

CVE-2026-86752 [MEDIUM] CWE-863 CVE-2026-86752: snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, r snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refact

CVE-2026-86743 [MEDIUM] CWE-639 CVE-2026-86743: Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, al Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access valida

CVE-2026-86767 [MEDIUM] CWE-200 CVE-2026-86767: Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester disp