Skip to content
OpenAdvisories
Medium WID-SEC-2026-1692 3 CVEs

Snipe-IT: Mehrere Schwachstellen

Published May 26, 2026 · Updated Jul 8, 2026 · Revision 4 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, und um Daten zu manipulieren.

Product

Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt.

Vulnerabilities 3

  • High 7.1
    CVE-2026-48507

    Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

    Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines w…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.5
    CVE-2026-48493

    Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

    Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.cre…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.9
    CVE-2026-48492

    Snipe-IT's selectlist visibility is too permissive

    Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of al…

    grokability snipe-it snipe/snipe-it Packagist

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2026-42433

  2. #3

    Referenz(en) aufgenommen: EUVD-2026-38635

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-35140

  4. #1

    Initiale Fassung

References