Snipe Snipe-It vulnerabilities

CVE-2026-55694 [HIGH] CWE-639 Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover ### Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. ### Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/{target_id

CVE-2026-55843 [HIGH] CWE-269 Snipe-IT has an Improper Privilege Management issue Snipe-IT has an Improper Privilege Management issue ## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally to `NormalizePermissionsPayloadAction`, which returns an empty array when the field is absent. The result is passed to `PreserveUnauthorizedPrivilegedPermissionsAction`, which selectively restores only the `superuser` key (when the editor is not a superuser

CVE-2026-49976 [MEDIUM] CWE-862 Snipe-IT Vulnerable to User Account Escalation via CSV Import Snipe-IT Vulnerable to User Account Escalation via CSV Import ### Impact The CSV user import in update mode bypasses user-edit authorization. A user with only the `import` permission can overwrite any non-admin user's email by uploading a CSV, then trigger a password reset to take over the account. `UserImporter.php` checks the `canEditAuthFields` gate and tries to strip auth fields from the model: `

CVE-2025-47226 [MEDIUM] CWE-425 Grokability Snipe-IT has incorrect authorization for accessing asset information Grokability Snipe-IT has incorrect authorization for accessing asset information Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

CVE-2026-48507 [HIGH] CWE-863 Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users ### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the u

CVE-2026-55482 [MEDIUM] CWE-639 Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update ### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patche

CVE-2021-4075 [HIGH] CWE-918 Server-Side Request Forgery in snipe/snipe-it Server-Side Request Forgery in snipe/snipe-it Admin users on the external network can perform blind POST-based SSRF (issue requests on behalf of the server into the internal network) via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network which can be escalated to higher-impact.

CVE-2023-5511 [HIGH] CWE-352 Cross-Site Request Forgery (CSRF) in snipe/snipe-it Cross-Site Request Forgery (CSRF) in snipe/snipe-it Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

CVE-2022-1155 [HIGH] CWE-613 Old sessions not blocked by login enable function in Snipe-IT Old sessions not blocked by login enable function in Snipe-IT Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the

CVE-2026-61807 [MEDIUM] CWE-79 Snipe-IT: Stored DOM XSS via table selected-count IDs Snipe-IT: Stored DOM XSS via table selected-count IDs ### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates

CVE-2022-0579 [MEDIUM] CWE-269 Improper Privilege Management in Snipe-IT Improper Privilege Management in Snipe-IT Snipe-IT prior to 5.3.9 is vulnerable to improper privilege management. A user who does not have access to the supplier module may view supplier content.

CVE-2022-1511 [MEDIUM] CWE-862 Improper Access Control in snipe/snipe-it Improper Access Control in snipe/snipe-it Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization.

CVE-2021-3858 [MEDIUM] CWE-352 Cross-Site Request Forgery in snipe-it Cross-Site Request Forgery in snipe-it snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).

CVE-2022-2997 [MEDIUM] CWE-384 Insufficient Session Expiration in snipe/snipe-it Insufficient Session Expiration in snipe/snipe-it Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.

CVE-2021-4130 [HIGH] CWE-352 snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2026-55475 [MEDIUM] CWE-863 Snipe-IT's import created_by can be overwritten Snipe-IT's import created_by can be overwritten ### Impact The `created_by` of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key.

CVE-2026-48493 [MEDIUM] CWE-863 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment ### Impact A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. ### Patches Patched in https://github.com/grokabilit

CVE-2026-55483 [MEDIUM] CWE-862 Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation ### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new u

CVE-2026-50550 [MEDIUM] CWE-862 Snipe-IT has a 2FA reset privilege bypass Snipe-IT has a 2FA reset privilege bypass ### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

CVE-2026-55478 [MEDIUM] CWE-639 Snipe-IT has missing object-level authorization in Kits API Snipe-IT has missing object-level authorization in Kits API ### Impact The API endpoint for adding a license to a predefined kit (`POST /api/v1/kits/{kit_id}/licenses`) only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit permissions can still bind a license that they