Total
135 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-116201 | 1 Snipeitapp | 1 Snipe-it | 2026-10-29 | N/A | 8.8 HIGH |
| Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation. | |||||
| CVE-2026-116198 | 1 Snipeitapp | 1 Snipe-it | 2026-10-29 | N/A | 4.3 MEDIUM |
| Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access. | |||||
| CVE-2026-116200 | 1 Snipeitapp | 1 Snipe-it | 2026-10-26 | N/A | 5.9 MEDIUM |
| Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords. | |||||
| CVE-2026-116199 | 1 Snipeitapp | 1 Snipe-it | 2026-10-26 | N/A | 8.1 HIGH |
| Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin. | |||||
| CVE-2026-48493 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 5.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0. | |||||
| CVE-2026-55542 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch. | |||||
| CVE-2026-48492 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch. | |||||
| CVE-2026-55516 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 7.7 HIGH |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55476 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0. | |||||
| CVE-2026-55475 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 5.7 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1. | |||||
| CVE-2026-55472 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55843 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0. | |||||
| CVE-2026-55515 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 5.0 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55460 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 7.1 HIGH |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55478 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 5.4 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55469 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55461 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.1 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate user edit action. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55462 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 4.3 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2. | |||||
| CVE-2026-55452 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 7.3 HIGH |
| Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0. | |||||
| CVE-2026-55474 | 1 Snipeitapp | 1 Snipe-it | 2026-10-25 | N/A | 6.5 MEDIUM |
| Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0. | |||||