Snipeitapp Snipe-It vulnerabilities

CVE-2025-63601 [CRITICAL] CWE-434 CVE-2025-63601: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenti Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

CVE-2025-15602 [HIGH] CWE-915 CVE-2025-15602: Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges tha Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the

CVE-2026-85617 [HIGH] CWE-639 CVE-2026-85617: snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete func snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.

CVE-2026-37709 [CRITICAL] CWE-284 CVE-2026-37709: Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-0 Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component

CVE-2026-86751 [CRITICAL] CWE-73 CVE-2026-86751: Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-au

CVE-2026-86762 [HIGH] CWE-862 CVE-2026-86762: Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware gro Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant

CVE-2026-63493 [HIGH] CWE-288 CVE-2026-63493: Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory

CVE-2026-44832 [HIGH] CWE-281 CVE-2026-44832: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permiss

CVE-2026-86770 [HIGH] CWE-178 CVE-2026-86770: Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowi Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeove

CVE-2026-55483 [HIGH] CWE-862 CVE-2026-55483: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users. Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative priv

CVE-2026-55643 [HIGH] CWE-863 CVE-2026-55643: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS flo Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licens

CVE-2026-116201 [HIGH] CWE-294 CVE-2026-116201: Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

CVE-2026-85616 [HIGH] CWE-639 CVE-2026-85616: Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a

CVE-2026-116199 [HIGH] CWE-285 CVE-2026-116199: Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallbac Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their orig

CVE-2026-86741 [HIGH] CWE-73 CVE-2026-86741: Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, e

CVE-2026-86750 [HIGH] CWE-863 CVE-2026-86750: Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested company_id / company_ids[] values are filtered against the actor's permitted companies (Co

CVE-2023-5452 [MEDIUM] CWE-79 CVE-2023-5452: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

CVE-2022-0611 [HIGH] CWE-862 CVE-2022-0611: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.

CVE-2026-54329 [HIGH] CWE-862 CVE-2026-54329: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. Thi

CVE-2026-86733 [HIGH] CWE-78 CVE-2026-86733: Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/ Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin