Skip to content
OpenAdvisories
Medium WID-SEC-2026-2073 17 CVEs

Snipe-IT: Mehrere Schwachstellen

Published Jun 24, 2026 · Updated Aug 19, 2026 · Revision 3 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.

Product

Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt.

Vulnerabilities 17

  • High 7.7
    CVE-2026-55516

    Snipe-IT: Cross-company asset maintenance re-parenting via API update

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing…

    grokability snipe-it snipe/snipe-it Packagist
  • High 7.1
    CVE-2026-55460

    Snipe-IT: Authorization bypass on bulk editing users

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorize…

    grokability snipe-it snipe/snipe-it Packagist
  • High 7.1
    CVE-2026-55474

    Snipe-IT: Directory traversal in displaySig

    Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the …

    grokability snipe-it snipe/snipe-it Packagist
  • High 7.0
    CVE-2026-55843

    Snipe-IT: Improper Privilege Management

    Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 6.5
    CVE-2026-55469

    Snipe-IT: Path traversal vulnerability via CSV import `image` field

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 6.3
    CVE-2026-61807

    Snipe-IT: Stored DOM XSS via table selected-count IDs

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the brow…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 6.2
    CVE-2026-55466

    Snipe-IT: Stored XSS via inline-served attachment

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 6.1
    CVE-2026-55461

    Snipe-IT: Open Redirect After User Edit

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.7
    CVE-2026-55475

    Snipe-IT: Import created_by can be overwritten

    Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import owner…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.3
    CVE-2026-55476

    Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

    Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.3
    CVE-2026-55478

    Snipe-IT: Missing object-level authorization in Kits API

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit pe…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.3
    CVE-2026-55479

    Snipe-IT: Incorrect permission for legacy license checkin API

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 5.0
    CVE-2026-55515

    Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related che…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.8
    CVE-2026-55452

    Snipe-IT: CSV formula injection in Activity Report export

    Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-pr…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.8
    CVE-2026-55464

    Snipe-IT: Stored XSS via Markdown custom field

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom f…

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.3
    CVE-2026-55462

    Snipe-IT: Authorization bypass on print inventory page

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.3
    CVE-2026-55472

    Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

    Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, …

    grokability snipe-it snipe/snipe-it Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-61807, EUVD-2026-62626

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-42983, EUVD-2026-42984, EUVD-2026-42990, EUVD-2026-42989, EUVD-2026-42986, EUVD-2026-42985, EUVD-2026-42992, EUVD-2026-42991, EUVD-2026-43001, EUVD-2026-43000, EUVD-2026-42999, EUVD-2026-42998, EUVD-2026-42997, EUVD-2026-42996, EUVD-2026-42995, EUVD-2026-42994

  3. #1

    Initiale Fassung

References