Grokability Snipe-It vulnerabilities

CVE-2026-55464 [MEDIUM] CWE-79 CVE-2026-55464: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but d Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and cli

CVE-2026-88894 [MEDIUM] CWE-863 CVE-2026-88894: Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and

CVE-2026-44833 [HIGH] CWE-601 CVE-2026-44833: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

CVE-2026-55461 [MEDIUM] CWE-601 CVE-2026-55461: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()-> Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate u

CVE-2026-61807 [MEDIUM] CWE-79 CVE-2026-61807: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML st

CVE-2026-114064 [MEDIUM] CWE-203 CVE-2026-114064: Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing fe Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and

CVE-2026-86752 [MEDIUM] CWE-863 CVE-2026-86752: snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, r snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refact

CVE-2026-86743 [MEDIUM] CWE-639 CVE-2026-86743: Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, al Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access valida

CVE-2026-86767 [MEDIUM] CWE-200 CVE-2026-86767: Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester disp

CVE-2026-55515 [MEDIUM] CWE-639 CVE-2026-55515: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report dele Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptanc

CVE-2026-86772 [MEDIUM] CWE-79 CVE-2026-86772: Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPres Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the

CVE-2026-86753 [MEDIUM] CWE-863 CVE-2026-86753: snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /a snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

CVE-2026-44831 [MEDIUM] CWE-79 CVE-2026-44831: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.

CVE-2026-55481 [MEDIUM] CWE-79 CVE-2026-55481: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_ Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Securit

CVE-2026-84206 [MEDIUM] CWE-863 CVE-2026-84206: Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.

CVE-2026-86761 [MEDIUM] CWE-639 CVE-2026-86761: snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpo snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regard

CVE-2026-86736 [MEDIUM] CWE-682 CVE-2026-86736: snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling t snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or sub

CVE-2026-116198 [MEDIUM] CWE-311 CVE-2026-116198: Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store tha Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the da

CVE-2026-55462 [MEDIUM] CWE-863 CVE-2026-55462: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and print Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permi

CVE-2026-55476 [MEDIUM] CWE-862 CVE-2026-55476: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/ Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue