Grokability Snipe-It vulnerabilities

CVE-2026-55479 [MEDIUM] CWE-863 CVE-2026-55479: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license ch Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another u

CVE-2026-55542 [MEDIUM] CWE-862 CVE-2026-55542: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature ima Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file b

CVE-2026-55703 [MEDIUM] CWE-862 CVE-2026-55703: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model bi

CVE-2026-55472 [MEDIUM] CWE-863 CVE-2026-55472: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Supp Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This

CVE-2026-86737 [MEDIUM] CWE-862 CVE-2026-86737: snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset} snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.

CVE-2026-86769 [MEDIUM] CWE-282 CVE-2026-86769: Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consuma Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed au

CVE-2026-86740 [LOW] CWE-212 CVE-2026-86740: Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesControlle Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physic

CVE-2026-86763 [LOW] CWE-639 CVE-2026-86763: Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer co Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As

CVE-2026-86744 [LOW] CWE-362 CVE-2026-86744: Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race conditi Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without taking a row lock or re-checking availabil