Grokability Snipe-It
86 CVEs affecting Grokability Snipe-It. Latest disclosed: 2026-10-21. Critical: 0, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85617 | High | 8.8 | 2026-09-04 | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
CVE-2026-55643 | High | 8.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because… |
CVE-2026-55483 | High | 8.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while cre… |
CVE-2026-44832 | High | 8.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to… |
CVE-2026-63498 | High | 8.7 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an aut… |
CVE-2026-86738 | High | 8.7 | 2026-09-08 | Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on grea… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-86751 | High | 8.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue se… |
CVE-2026-86741 | High | 8.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege… |
CVE-2026-85616 | High | 8.5 | 2026-09-04 | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2026-63493 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the perso… |
CVE-2026-62368 | High | 8.1 | 2026-09-24 | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app… |
CVE-2026-86770 | High | 8.1 | 2026-09-09 | Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by register… |
CVE-2026-86762 | High | 8.1 | 2026-09-09 | Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not… |
CVE-2026-86750 | High | 7.7 | 2026-09-09 | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersContr… |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2026-86771 | High | 7.6 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inj… |
CVE-2026-86754 | High | 7.3 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with… |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |