Skip to content
OpenAdvisories
Medium WID-SEC-2026-2051 3 CVEs

Snipe-IT: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Jun 23, 2026 · Updated Aug 19, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-49976

    Snipe-IT: User Account Escalation via CSV Import

    Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImpor…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.9
    CVE-2026-49870

    Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

    Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by con…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.8
    CVE-2026-50550

    Snipe-IT: 2FA reset privilege bypass

    Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update acc…

    grokability snipe-it snipe/snipe-it Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-62675, EUVD-2026-62677, EUVD-2026-62676

  2. #1

    Initiale Fassung

References