DeutschShown in its original language — a full translation is planned for a future version.
Snipe-IT: Mehrere Schwachstellen
view advisory published 2026-06-14
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um administrative Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-55519US | — | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's o… | ||||
| CVE-2026-55483US | high8.8OT elevated | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because… | ||||
| CVE-2026-55482US | — | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id direc… | ||||
| CVE-2026-55542US | medium4.3OT elevated | — | ||
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments,… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-33g4-646g-qwmm vom 2026-06-14external
- GitHub Security Advisory GHSA-6mmj-jhqj-6c6q vom 2026-06-14external
- GitHub Security Advisory GHSA-hf68-g98v-wp9g vom 2026-06-14external
- GitHub Security Advisory GHSA-x667-r589-43m7 vom 2026-06-14external
- WID-SEC-W-2026-1918 - CSAF Versionself
- WID-SEC-2026-1918 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan