Snipeitapp Snipe-It vulnerabilities

CVE-2022-23064 [HIGH] CWE-74 CVE-2022-23064: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a spe In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVE-2026-86738 [HIGH] CWE-79 CVE-2026-86738: Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, e

CVE-2026-55516 [HIGH] CWE-639 CVE-2026-55516: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an as

CVE-2026-55466 [HIGH] CWE-79 CVE-2026-55466: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin an

CVE-2024-5685 [HIGH] CWE-862 CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CVE-2026-55452 [HIGH] CWE-1236 CVE-2026-55452: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report

CVE-2026-86754 [HIGH] CWE-863 CVE-2026-86754: Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions la

CVE-2025-59713 [HIGH] CWE-502 CVE-2025-59713: Snipe-IT before 8.1.18 allows unsafe deserialization. Snipe-IT before 8.1.18 allows unsafe deserialization.

CVE-2026-86771 [HIGH] CWE-918 CVE-2026-86771: Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal

CVE-2026-86759 [HIGH] CWE-862 CVE-2026-86759: Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

CVE-2026-55474 [MEDIUM] CWE-23 CVE-2026-55474: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue

CVE-2026-62368 [HIGH] CWE-79 CVE-2026-62368: Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.crea Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes

CVE-2024-51094 [HIGH] CWE-1236 CVE-2024-51094: An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile n An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal

CVE-2026-86774 [MEDIUM] CWE-284 CVE-2026-86774: Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy whe Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate

CVE-2026-50550 [MEDIUM] CWE-863 CVE-2026-50550: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_

CVE-2024-48987 [MEDIUM] CWE-1393 CVE-2024-48987: Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an a Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

CVE-2026-55469 [MEDIUM] CWE-22 CVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVE-2024-51093 [HIGH] CWE-79 CVE-2024-51093: Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.

CVE-2026-55460 [HIGH] CWE-863 CVE-2026-55460: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in

CVE-2026-86758 [MEDIUM] CWE-204 CVE-2026-86758: Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and AP Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the