Snipeitapp Snipe-It vulnerabilities

CVE-2026-86735 [MEDIUM] CWE-918 CVE-2026-86735: snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUr snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access interna

CVE-2026-55464 [MEDIUM] CWE-79 CVE-2026-55464: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but d Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and cli

CVE-2026-88894 [MEDIUM] CWE-863 CVE-2026-88894: Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and

CVE-2026-44833 [HIGH] CWE-601 CVE-2026-44833: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.

CVE-2026-55461 [MEDIUM] CWE-601 CVE-2026-55461: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()-> Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate u

CVE-2026-61807 [MEDIUM] CWE-79 CVE-2026-61807: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML st

CVE-2026-86752 [MEDIUM] CWE-863 CVE-2026-86752: snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, r snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refact

CVE-2026-86743 [MEDIUM] CWE-639 CVE-2026-86743: Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, al Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access valida

CVE-2022-0178 [MEDIUM] CWE-862 CVE-2022-0178: Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.

CVE-2026-86767 [MEDIUM] CWE-200 CVE-2026-86767: Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester disp

CVE-2022-44381 [MEDIUM] CWE-203 CVE-2022-44381: Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

CVE-2025-65621 [MEDIUM] CWE-79 CVE-2025-65621: Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject Java Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

CVE-2026-55515 [MEDIUM] CWE-639 CVE-2026-55515: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report dele Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptanc

CVE-2026-86772 [MEDIUM] CWE-79 CVE-2026-86772: Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPres Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the

CVE-2025-65622 [MEDIUM] CWE-79 CVE-2025-65622: Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

CVE-2026-86753 [MEDIUM] CWE-863 CVE-2026-86753: snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /a snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

CVE-2019-10118 [MEDIUM] CWE-79 CVE-2019-10118: Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the A Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.

CVE-2025-64027 [MEDIUM] CWE-79 CVE-2025-64027: Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the C Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary H

CVE-2022-1380 [MEDIUM] CWE-79 CVE-2022-1380: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

CVE-2022-1445 [MEDIUM] CWE-79 CVE-2022-1445: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.