Snipe Snipe-It vulnerabilities

CVE-2026-55478 [MEDIUM] CWE-639 Snipe-IT has missing object-level authorization in Kits API Snipe-IT has missing object-level authorization in Kits API ### Impact The API endpoint for adding a license to a predefined kit (`POST /api/v1/kits/{kit_id}/licenses`) only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit permissions can still bind a license that they

CVE-2026-63498 [HIGH] CWE-79 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it through xml-stylesheet. When

CVE-2026-55519 [LOW] CWE-285 Snipe-IT has Improper Authorization in File Deletion (IDOR) Snipe-IT has Improper Authorization in File Deletion (IDOR) ### Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit permissions to delete files attached to any asset in the system, regardless of ownership or company assignment. This constitutes an Insecure Direct Object Reference (IDOR) vulnerability caused by a class-l

CVE-2026-55464 [MEDIUM] CWE-79 Snipe-IT vulnerable to stored XSS via Markdown custom field Snipe-IT vulnerable to stored XSS via Markdown custom field ### Impact CommonMark is configured with `html_input => 'escape'`, which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with `assets.edit` permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbi

CVE-2026-55461 [MEDIUM] CWE-601 Snipe-IT has an Open Redirect After User Edit Snipe-IT has an Open Redirect After User Edit ### Impact The user edit flow stores `url()->previous()` into Laravel's intended URL session value and later redirects with `redirect()->intended(...)` when `redirect_option=back` is submitted. Because the previous URL is derived from the attacker-controlled `Referer` header, an authenticated user performing a normal user-edit action can be redirected to an external attack

CVE-2026-61807 [MEDIUM] CWE-79 Snipe-IT: Stored DOM XSS via table selected-count IDs Snipe-IT: Stored DOM XSS via table selected-count IDs ### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates

CVE-2026-44833 [MEDIUM] CWE-601 Snipe-IT has an open redirect vulnerability Snipe-IT has an open redirect vulnerability Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. ### Impact - **Phishing**: Redirect users to fake login pages to steal credentials - **Session Hijacking**: Redirect to attacker site that captures session cookies via JavaScript - **Malware Distribution**: Redirect to

CVE-2022-0178 [MEDIUM] CWE-284 Improper Access Control in snipe-it Improper Access Control in snipe-it Users with no system permissions are able to see and create personal access tokens

CVE-2022-44381 [MEDIUM] CWE-203 Snipe-IT allows attackers to check whether a user account exists Snipe-IT allows attackers to check whether a user account exists Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

CVE-2026-55515 [MEDIUM] CWE-639 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint ### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directl

CVE-2025-65621 [MEDIUM] CWE-269 Snipe-IT is vulnerable to stored cross-site scripting Snipe-IT is vulnerable to stored cross-site scripting Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

CVE-2025-65622 [MEDIUM] CWE-79 Snipe-IT allows stored XSS via the Locations "Country" field Snipe-IT allows stored XSS via the Locations "Country" field Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

CVE-2022-32060 [MEDIUM] CWE-79 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2019-10118 [MEDIUM] CWE-79 Snipe-IT XSS Vulnerability Snipe-IT XSS Vulnerability Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.

CVE-2022-1380 [MEDIUM] CWE-79 Cross-site Scripting in snipe-it Cross-site Scripting in snipe-it Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

CVE-2022-1445 [MEDIUM] CWE-79 Stored cross-site scripting in Snipe-IT Stored cross-site scripting in Snipe-IT Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the `checked_out_to` parameter is not escaped. The vulnerability is capable of stealing a user's cookie.

CVE-2025-64027 [MEDIUM] CWE-79 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update req

CVE-2022-32061 [MEDIUM] CWE-79 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting Snipe-IT 6.0.2 vulnerable to Cross-site Scripting An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2026-55481 [MEDIUM] CWE-79 Snipe-IT has CSS Injection via `header_color` Setting Snipe-IT has CSS Injection via `header_color` Setting ### Impact Because `default.blade.php` is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account (or who is a malicious insider) can use this to silently exfiltrate session tokens from all other users, including

CVE-2026-44831 [MEDIUM] CWE-79 Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) ### Impact Users with component view access could be impacted by an unescaped `notes` column. ### Patches This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater. ### Workarounds None.