Snipeitapp Snipe-It vulnerabilities

CVE-2025-63601 [CRITICAL] CWE-434 CVE-2025-63601: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenti Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

CVE-2025-15602 [HIGH] CWE-915 CVE-2025-15602: Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges tha Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the

CVE-2026-37709 [CRITICAL] CWE-284 CVE-2026-37709: Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-0 Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component

CVE-2026-44832 [HIGH] CWE-281 CVE-2026-44832: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permiss

CVE-2023-5452 [MEDIUM] CWE-79 CVE-2023-5452: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

CVE-2022-0611 [HIGH] CWE-862 CVE-2022-0611: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.

CVE-2022-23064 [HIGH] CWE-74 CVE-2022-23064: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a spe In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVE-2025-59713 [HIGH] CWE-502 CVE-2025-59713: Snipe-IT before 8.1.18 allows unsafe deserialization. Snipe-IT before 8.1.18 allows unsafe deserialization.

CVE-2024-5685 [HIGH] CWE-862 CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CVE-2024-51094 [HIGH] CWE-1236 CVE-2024-51094: An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile n An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal

CVE-2024-48987 [MEDIUM] CWE-1393 CVE-2024-48987: Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an a Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

CVE-2024-51093 [HIGH] CWE-79 CVE-2024-51093: Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.

CVE-2026-38533 [MEDIUM] CWE-285 CVE-2026-38533: An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

CVE-2026-48507 [HIGH] CWE-863 CVE-2026-48507: Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not th

CVE-2025-47226 [LOW] CWE-425 CVE-2025-47226: Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

CVE-2023-5511 [HIGH] CWE-352 CVE-2023-5511: Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

CVE-2022-1155 [HIGH] CWE-840 CVE-2022-1155: Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

CVE-2021-3858 [HIGH] CWE-352 CVE-2021-3858: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-0579 [MEDIUM] CWE-862 CVE-2022-0579: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.

CVE-2022-1511 [MEDIUM] CWE-862 CVE-2022-1511: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.