DeutschShown in its original language — a full translation is planned for a future version.
Snipe-IT: Mehrere Schwachstellen
view advisory published 2026-08-24
Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren, Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen.
01
describes (46)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-63498US | medium5.4 | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with… | ||||
| CVE-2026-63493US | high8.1OT elevated | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API… | ||||
| CVE-2026-62368US | high8.4 | — | ||
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPres… | ||||
| CVE-2026-86774US | medium6.3 | — | ||
Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authentica… | ||||
| CVE-2026-86773US | medium5.4OT elevated | — | ||
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel… | ||||
| CVE-2026-86772US | medium5.4 | — | ||
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the… | ||||
| CVE-2026-86771US | high7.6 | — | ||
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCP… | ||||
| CVE-2026-86770US | high8.1 | — | ||
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with… | ||||
| CVE-2026-86769US | medium4.3 | — | ||
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the cre… | ||||
| CVE-2026-86768US | medium5.4 | — | ||
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targe… | ||||
| CVE-2026-86767US | medium5.0 | — | ||
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated u… | ||||
| CVE-2026-86766US | medium6.5 | — | ||
Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The reque… | ||||
| CVE-2026-86765US | medium6.5OT elevated | — | ||
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission bu… | ||||
| CVE-2026-86764US | medium6.5OT elevated | — | ||
Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpo… | ||||
| CVE-2026-86763US | low3.5 | — | ||
Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The compone… | ||||
| CVE-2026-86762US | high8.1OT elevated | — | ||
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's P… | ||||
| CVE-2026-86761US | medium4.3 | — | ||
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attacke… | ||||
| CVE-2026-86760US | medium5.4OT elevated | — | ||
Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route a… | ||||
| CVE-2026-86759US | high7.1OT elevated | — | ||
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers… | ||||
| CVE-2026-86758US | medium6.5 | — | ||
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permissi… | ||||
showing 20 of 46
02
references
External citations — patches, advisories, analysis.
- Grokability Snipe-IT Releases vom 2026-08-24external
- GitHub Security Advisory GHSA-2232-926w-qvr9 vom 2026-08-24external
- GitHub Security Advisory GHSA-396x-xmvh-p563 vom 2026-08-24external
- GitHub Security Advisory GHSA-3j84-c68v-g76m vom 2026-08-24external
- GitHub Security Advisory GHSA-4c4h-cpgf-h4qr vom 2026-08-24external
- GitHub Security Advisory GHSA-4cr5-3hw8-8w5f vom 2026-08-24external
- GitHub Security Advisory GHSA-4j5f-mm59-hf9w vom 2026-08-24external
- GitHub Security Advisory GHSA-4vcv-fc5x-jjwv vom 2026-08-24external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan