CVE-2026-63498 | High | 8.7 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an aut… |
CVE-2026-63493 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the perso… |
CVE-2026-62368 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app… |
CVE-2026-88894 | Medium | 5.4 | 2026-09-10 | Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk… |
CVE-2026-86774 | Medium | 6.3 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission… |
CVE-2026-86773 | Medium | 5.4 | 2026-09-09 | Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints a… |
CVE-2026-86772 | Medium | 5.4 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rende… |
CVE-2026-86771 | High | 7.6 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inj… |
CVE-2026-86770 | High | 8.1 | 2026-09-09 | Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by register… |
CVE-2026-86769 | Medium | 4.3 | 2026-09-09 | Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target… |
CVE-2026-86768 | Medium | 5.4 | 2026-09-09 | Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inven… |
CVE-2026-86767 | Medium | 5.0 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, all… |
CVE-2026-86766 | Medium | 6.5 | 2026-09-09 | Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}… |
CVE-2026-86765 | Medium | 6.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users wi… |
CVE-2026-86764 | Medium | 6.5 | 2026-09-09 | Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/… |
CVE-2026-86763 | Low | 3.5 | 2026-09-09 | Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.inde… |
CVE-2026-86762 | High | 8.1 | 2026-09-09 | Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not… |
CVE-2026-86761 | Medium | 4.3 | 2026-09-09 | snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks… |
CVE-2026-86760 | Medium | 5.4 | 2026-09-09 | Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The sin… |
CVE-2026-86759 | High | 7.1 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify a… |
CVE-2026-86758 | Medium | 6.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only l… |
CVE-2026-86757 | Medium | 6.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date… |
CVE-2026-86756 | Medium | 6.1 | 2026-09-09 | Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoin… |
CVE-2026-86755 | Medium | 5.4 | 2026-09-09 | Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*)… |
CVE-2026-86754 | High | 7.3 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with… |
CVE-2026-86753 | Medium | 4.3 | 2026-09-09 | snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticate… |
CVE-2026-86752 | Medium | 5.4 | 2026-09-09 | snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-la… |
CVE-2026-86751 | High | 8.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue se… |
CVE-2026-86750 | High | 7.7 | 2026-09-09 | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersContr… |
CVE-2026-86749 | Medium | 6.3 | 2026-09-09 | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's… |
CVE-2026-86748 | Medium | 6.1 | 2026-09-09 | Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or inval… |
CVE-2026-86747 | Medium | 5.4 | 2026-09-09 | Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/s… |
CVE-2026-86746 | Medium | 6.4 | 2026-09-09 | Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within comp… |
CVE-2026-86745 | Medium | 6.5 | 2026-09-09 | Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsControl… |
CVE-2026-86744 | Low | 2.2 | 2026-09-09 | Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::check… |
CVE-2026-86743 | Medium | 5.0 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acc… |
CVE-2026-86742 | Medium | 6.5 | 2026-09-09 | Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceRepo… |
CVE-2026-86741 | High | 8.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege… |
CVE-2026-86740 | Low | 3.8 | 2026-09-09 | Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), a… |
CVE-2026-86739 | Low | 3.1 | 2026-09-09 | Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\Acceptanc… |
CVE-2026-86738 | High | 8.7 | 2026-09-08 | Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on grea… |
CVE-2026-86737 | Medium | 4.3 | 2026-09-08 | snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asse… |
CVE-2026-86736 | Medium | 4.3 | 2026-09-08 | snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.reques… |
CVE-2026-86735 | Medium | 5.0 | 2026-09-08 | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addr… |
CVE-2026-86734 | Medium | 6.5 | 2026-09-08 | Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit… |
CVE-2026-86733 | High | 7.2 | 2026-09-08 | Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-… |
CVE-2026-85617 | High | 8.8 | 2026-09-04 | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
CVE-2026-85616 | High | 8.5 | 2026-09-04 | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
CVE-2026-84206 | Medium | 4.3 | 2026-09-01 | Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to res… |
CVE-2026-61807 | | | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-sele… |
CVE-2026-55703 | Medium | 4.3 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets… |
CVE-2026-55694 | | | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's rando… |
CVE-2026-55643 | | | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because… |
CVE-2026-55519 | Medium | 5.4 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets… |
CVE-2026-55483 | | | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while cre… |
CVE-2026-55482 | Medium | 6.3 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to su… |
CVE-2026-50550 | Medium | 5.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through a… |
CVE-2026-49976 | Medium | 6.5 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of… |
CVE-2026-49870 | Medium | 5.9 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker wit… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-55515 | Medium | 5.0 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes Checko… |
CVE-2026-55481 | Medium | 4.8 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS styl… |
CVE-2026-55479 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permissi… |
CVE-2026-55475 | Medium | 5.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to… |
CVE-2026-55469 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal s… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-55462 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and… |
CVE-2026-55461 | Medium | 6.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into… |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |
CVE-2026-55843 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermiss… |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2026-55478 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not aut… |
CVE-2026-55476 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cance… |
CVE-2026-55474 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upl… |
CVE-2026-55472 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location… |
CVE-2026-55464 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, a… |
CVE-2026-55460 | High | 7.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2026-48492 | Medium | 6.5 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check… |
CVE-2026-55542 | Medium | 4.3 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S… |
CVE-2026-48493 | Medium | 5.5 | 2026-06-23 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and… |
CVE-2026-48507 | High | 7.1 | 2026-06-08 | Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` pe… |
CVE-2026-44833 | Medium | 5.9 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious s… |
CVE-2026-44832 | High | 8.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to… |
CVE-2026-44831 | Medium | 4.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting i… |