Grokability Snipe-It
39 CVEs affecting Grokability Snipe-It. Latest disclosed: 2026-09-04. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85617 | High | 8.8 | 2026-09-04 | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
CVE-2026-44832 | High | 8.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-85616 | High | 8.5 | 2026-09-04 | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |
CVE-2026-55460 | High | 7.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can… |
CVE-2026-48507 | High | 7.1 | 2026-06-08 | Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` pe… |
CVE-2026-49976 | Medium | 6.5 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of… |
CVE-2026-55469 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal s… |
CVE-2026-55843 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermiss… |
CVE-2026-55474 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upl… |
CVE-2026-48492 | Medium | 6.5 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check… |
CVE-2026-55482 | Medium | 6.3 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to su… |
CVE-2026-55461 | Medium | 6.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into… |
CVE-2026-49870 | Medium | 5.9 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker wit… |
CVE-2026-44833 | Medium | 5.9 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious s… |
CVE-2026-50550 | Medium | 5.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through a… |
CVE-2026-55475 | Medium | 5.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to… |