Snipeitapp Snipe-It vulnerabilities

CVE-2026-48492 [MEDIUM] CWE-862 CVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/ Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions ar

CVE-2026-38533 [MEDIUM] CWE-285 CVE-2026-38533: An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

CVE-2026-86746 [MEDIUM] CWE-269 CVE-2026-86746: Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enf Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, inclu

CVE-2026-49870 [MEDIUM] CWE-770 CVE-2026-49870: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limi Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When t

CVE-2026-48507 [HIGH] CWE-863 CVE-2026-48507: Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not th

CVE-2026-55843 [MEDIUM] CWE-269 CVE-2026-55843: Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another ad

CVE-2026-49976 [MEDIUM] CWE-863 CVE-2026-49976: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activ

CVE-2026-86765 [MEDIUM] CWE-862 CVE-2026-86765: Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are sub Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned

CVE-2026-86764 [MEDIUM] CWE-862 CVE-2026-86764: Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authe Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view fla

CVE-2026-55694 [MEDIUM] CWE-639 CVE-2026-55694: Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /ap Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Control

CVE-2026-86757 [MEDIUM] CWE-862 CVE-2026-86757: Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form t Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset

CVE-2026-86739 [MEDIUM] CWE-252 CVE-2026-86739: Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signatur Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a

CVE-2026-86766 [MEDIUM] CWE-362 CVE-2026-86766: Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable chec Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without lock

CVE-2023-5511 [HIGH] CWE-352 CVE-2023-5511: Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

CVE-2026-86749 [MEDIUM] CWE-252 CVE-2026-86749: Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operation Snipe-IT versions put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where

CVE-2026-55482 [MEDIUM] CWE-639 CVE-2026-55482: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1

CVE-2025-47226 [LOW] CWE-425 CVE-2025-47226: Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

CVE-2022-1155 [HIGH] CWE-840 CVE-2022-1155: Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

CVE-2026-86734 [MEDIUM] CWE-400 CVE-2026-86734: Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{ac Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the m

CVE-2021-3858 [HIGH] CWE-352 CVE-2021-3858: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)