Snipe Snipe-It vulnerabilities

CVE-2026-55460 [HIGH] CWE-863 Snipe-IT has an authorization bypass on bulk editing users Snipe-IT has an authorization bypass on bulk editing users ### Impact An authenticated non-admin user with `users.view` and `users.edit`, but without `users.delete`, can directly POST to `/users/bulksave` and soft-delete another non-admin user. The UI and confirmation route require `users.delete`, but the destructive sink only authorizes `update`. ### Attacker Model Authenticated non-admin user with: ~~~

CVE-2024-51093 [HIGH] CWE-79 Cross Site Scripting vulnerability in Snipe-IT Cross Site Scripting vulnerability in Snipe-IT Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.

CVE-2026-49870 [MEDIUM] CWE-770 Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` ### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side (`config/google2fa.php window=1`), so at any instant 3 of 1,000,00

CVE-2026-48492 [MEDIUM] CWE-862 Snipe-IT's selectlist visibility is too permissive Snipe-IT's selectlist visibility is too permissive ### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user

CVE-2026-55843 [HIGH] CWE-269 Snipe-IT has an Improper Privilege Management issue Snipe-IT has an Improper Privilege Management issue ## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally to `NormalizePermissionsPayloadAction`, which returns an empty array when the field is absent. The result is passed to `PreserveUnauthorizedPrivilegedPermissionsAction`, which selectively restores only the `superuser` key (when the editor is not a superuser

CVE-2026-49976 [MEDIUM] CWE-862 Snipe-IT Vulnerable to User Account Escalation via CSV Import Snipe-IT Vulnerable to User Account Escalation via CSV Import ### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admin user's email by uploading a CSV, then trigger a password reset to take over the account. `UserImporter.php` checks the `canEditAuthFields` gate and tries to strip auth fields from the model: `

CVE-2025-47226 [MEDIUM] CWE-425 Grokability Snipe-IT has incorrect authorization for accessing asset information Grokability Snipe-IT has incorrect authorization for accessing asset information Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

CVE-2026-55694 [HIGH] CWE-639 Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover ### Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. ### Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/{target_id

CVE-2026-48507 [HIGH] CWE-863 Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users ### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the u

CVE-2026-55482 [MEDIUM] CWE-639 Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update ### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patche

CVE-2023-5511 [HIGH] CWE-352 Cross-Site Request Forgery (CSRF) in snipe/snipe-it Cross-Site Request Forgery (CSRF) in snipe/snipe-it Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

CVE-2021-4075 [HIGH] CWE-918 Server-Side Request Forgery in snipe/snipe-it Server-Side Request Forgery in snipe/snipe-it Admin users on the external network can perform blind POST-based SSRF (issue requests on behalf of the server into the internal network) via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network which can be escalated to higher-impact.

CVE-2022-1155 [HIGH] CWE-613 Old sessions not blocked by login enable function in Snipe-IT Old sessions not blocked by login enable function in Snipe-IT Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the

CVE-2022-1511 [MEDIUM] CWE-862 Improper Access Control in snipe/snipe-it Improper Access Control in snipe/snipe-it Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization.

CVE-2022-0579 [MEDIUM] CWE-269 Improper Privilege Management in Snipe-IT Improper Privilege Management in Snipe-IT Snipe-IT prior to 5.3.9 is vulnerable to improper privilege management. A user who does not have access to the supplier module may view supplier content.

CVE-2021-3858 [MEDIUM] CWE-352 Cross-Site Request Forgery in snipe-it Cross-Site Request Forgery in snipe-it snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).

CVE-2022-2997 [MEDIUM] CWE-384 Insufficient Session Expiration in snipe/snipe-it Insufficient Session Expiration in snipe/snipe-it Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.

CVE-2021-4130 [HIGH] CWE-352 snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2026-55475 [MEDIUM] CWE-863 Snipe-IT's import created_by can be overwritten Snipe-IT's import created_by can be overwritten ### Impact The `created_by` of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.

CVE-2026-48493 [MEDIUM] CWE-863 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment ### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. ### Patches Patched in https://github.com/grokabilit