Snipeitapp Snipe-It vulnerabilities

CVE-2026-86755 [MEDIUM] CWE-863 CVE-2026-86755: Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-toke Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). An

CVE-2022-1511 [MEDIUM] CWE-862 CVE-2022-1511: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.

CVE-2022-0579 [MEDIUM] CWE-862 CVE-2022-0579: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.

CVE-2026-86742 [MEDIUM] CWE-1236 CVE-2026-86742: Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance re Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config(

CVE-2021-4130 [HIGH] CWE-352 CVE-2021-4130: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-2997 [HIGH] CWE-384 CVE-2022-2997: Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.

CVE-2026-86760 [MEDIUM] CWE-863 CVE-2026-86760: Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in ap Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit

CVE-2026-86745 [MEDIUM] CWE-1236 CVE-2026-86745: Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the co Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Cs

CVE-2026-86756 [MEDIUM] CWE-601 CVE-2026-86756: Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and LoginController later issued redirect()->intended(), which passes

CVE-2026-55475 [MEDIUM] CWE-863 CVE-2026-55475: Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.

CVE-2026-48493 [MEDIUM] CWE-863 CVE-2026-48493: Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only user Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.

CVE-2026-86768 [MEDIUM] CWE-20 CVE-2026-86768: Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authe Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references

CVE-2026-19579 [MEDIUM] CWE-639 CVE-2026-19579: Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the ass Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-emp

CVE-2026-55478 [MEDIUM] CWE-639 CVE-2026-55478: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licens Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This iss

CVE-2026-116200 [MEDIUM] CWE-319 CVE-2026-116200: Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing o Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

CVE-2026-86747 [MEDIUM] CWE-863 CVE-2026-86747: Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the re Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/sent_reminder (ReportsController::sentAssetAcceptanceReminder) and DELETE /reports/unaccepted_assets/{acceptanceId}/delete (ReportsController::deleteAssetAcceptance) are not correctly scoped wh

CVE-2026-63498 [MEDIUM] CWE-79 CVE-2026-63498: Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint G Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() p

CVE-2026-86748 [MEDIUM] CWE-460 CVE-2026-86748: Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in th Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

CVE-2026-55519 [MEDIUM] CWE-285 CVE-2026-55519: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generi Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authoriz

CVE-2026-86773 [MEDIUM] CVE-2026-86773: Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, upd Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authe