Skip to content
OpenAdvisories
High WID-SEC-2026-2792 3 CVEs

Snipe-IT: Mehrere Schwachstellen

Published Aug 11, 2026 · Updated Aug 19, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder möglicherweise einen Denial-of-Service-Zustand auszulösen.

Product

Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt.

Vulnerabilities 3

  • High 7.6
    CVE-2026-55643

    Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

    Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v…

    grokability snipe-it snipe/snipe-it Packagist
  • High 7.1
    CVE-2026-55694

    Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

    Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. …

    grokability snipe-it snipe/snipe-it Packagist
  • Medium 4.3
    CVE-2026-55703

    Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

    Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesContr…

    grokability snipe-it snipe/snipe-it Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-62631, EUVD-2026-62628, EUVD-2026-62627

  2. #1

    Initiale Fassung

References