Skip to content
OpenAdvisories
High WID-SEC-2026-2981 46 CVEs

Snipe-IT: Mehrere Schwachstellen

Published Aug 24, 2026 · Updated Sep 24, 2026 · Revision 5 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren, Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen.

Product

Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt.

Vulnerabilities 46

  • High 8.7
    CVE-2026-63498

    Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with…

    grokability snipe-it snipe/snipe-it Packagist
  • High 8.7
    CVE-2026-86738

    Snipe-IT before 8.7.0 CSS Injection via Custom CSS

    Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and …

    grokability snipe-it
  • High 8.6
    CVE-2026-63493

    Snipe-IT: 2FA bypass via the API token flow

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTw…

    grokability snipe-it snipe/snipe-it Packagist
  • High 8.5
    CVE-2026-86741

    Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

    Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote …

    grokability snipe-it
  • High 8.5
    CVE-2026-86751

    Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

    Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes tha…

    grokability snipe-it
  • High 8.1
    CVE-2026-62368

    Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

    Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When…

    grokability snipe-it snipe/snipe-it Packagist
  • High 8.1
    CVE-2026-86762

    Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

    Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is …

    grokability snipe-it
  • High 8.1
    CVE-2026-86770

    Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation

    Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default…

    grokability snipe-it
  • High 7.7
    CVE-2026-86750

    snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

    Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the reque…

    grokability snipe-it
  • High 7.6
    CVE-2026-86771

    Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

    Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value c…

    grokability snipe-it
  • High 7.3
    CVE-2026-86754

    Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

    Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens…

    grokability snipe-it
  • High 7.2
    CVE-2026-86733

    Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

    Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local sh…

    grokability snipe-it
  • High 7.1
    CVE-2026-86759

    Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

    Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86734

    Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

    Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note value…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86742

    Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

    Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling e…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86745

    Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

    Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/set…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86757

    Snipe-IT before 8.7.0 Information Disclosure via Custom Fields

    Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86758

    Snipe-IT before 8.7.0 License Key Exposure via CSV Export

    Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via …

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86764

    Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

    Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked com…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86765

    Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

    Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in pr…

    grokability snipe-it
  • Medium 6.5
    CVE-2026-86766

    Snipe-IT 8.6.3 Race Condition via Consumable Checkout

    Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the dat…

    grokability snipe-it
  • Medium 6.4
    CVE-2026-86746

    Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

    Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component sn…

    grokability snipe-it
  • Medium 6.3
    CVE-2026-86749

    snipe-it before 8.7.0 Data Loss via Failed Image Write

    Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) cal…

    grokability snipe-it
  • Medium 6.3
    CVE-2026-86774

    Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

    Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without …

    grokability snipe-it
  • Medium 6.1
    CVE-2026-86748

    Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

    Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

    grokability snipe-it
  • Medium 6.1
    CVE-2026-86756

    Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

    Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86747

    snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

    Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/sent_reminder (ReportsController::sentAssetAcceptanceReminder) and DELETE /reports/unaccepted_assets/…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86752

    snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

    snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write aud…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86755

    Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

    Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enfor…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86760

    snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

    Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canE…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86768

    Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

    Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable ch…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86772

    Snipe-IT 8.6.3 Stored XSS via Department Names

    Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with depar…

    grokability snipe-it
  • Medium 5.4
    CVE-2026-86773

    Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

    Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Pre…

    grokability snipe-it
  • Medium 5.0
    CVE-2026-86735

    snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

    snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URL…

    grokability snipe-it
  • Medium 5.0
    CVE-2026-86743

    Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

    Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export …

    grokability snipe-it
  • Medium 5.0
    CVE-2026-86767

    Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

    Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all compan…

    grokability snipe-it
  • Medium 4.3
    CVE-2026-84206

    Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

    Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk res…

    grokability snipe-it
  • Medium 4.3
    CVE-2026-86736

    snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

    snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can re…

    grokability snipe-it
  • Medium 4.3
    CVE-2026-86737

    snipe-it before 8.7.0 Missing Authorization via barcode endpoint

    snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross…

    grokability snipe-it
  • Medium 4.3
    CVE-2026-86753

    snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

    snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asse…

    grokability snipe-it
  • Medium 4.3
    CVE-2026-86761

    snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints

    snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned …

    grokability snipe-it
  • Medium 4.3
    CVE-2026-86769

    Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout

    Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attacker…

    grokability snipe-it
  • Low 3.8
    CVE-2026-86740

    Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

    Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing at…

    grokability snipe-it
  • Low 3.5
    CVE-2026-86763

    snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

    Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and…

    grokability snipe-it
  • Low 3.1
    CVE-2026-86739

    Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

    Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure…

    grokability snipe-it
  • Low 2.2
    CVE-2026-86744

    snipe-it before 8.7.0 Race Condition in Asset Checkout

    Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mut…

    grokability snipe-it

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2026-86291, EUVD-2026-86288, EUVD-2026-86292

  2. #4

    Referenz(en) aufgenommen: CVE-2026-86768, EUVD-2026-74945, CVE-2026-86751, EUVD-2026-74928, CVE-2026-86750, EUVD-2026-74927, CVE-2026-86749, EUVD-2026-74926, CVE-2026-86748, EUVD-2026-74925, CVE-2026-86747, EUVD-2026-74924, CVE-2026-86746, EUVD-2026-74923, CVE-2026-86745, EUVD-2026-74922, CVE-2026-86744, EUVD-2026-74921, CVE-2026-86743, EUVD-2026-74920, CVE-2026-86742, EUVD-2026-74919, CVE-2026-86741, EUVD-2026-74918, CVE-2026-86740, EUVD-2026-74917, CVE-2026-86739, EUVD-2026-74916, CVE-2026-86767, EUVD-2026-74944, CVE-2026-86766, EUVD-2026-74943, CVE-2026-86765, EUVD-2026-74942, CVE-2026-86764, EUVD-2026-74941, CVE-2026-86763, EUVD-2026-74940, CVE-2026-86762, EUVD-2026-74939, CVE-2026-86761, EUVD-2026-74938, CVE-2026-86755, EUVD-2026-74932, CVE-2026-86753, EUVD-2026-74930, CVE-2026-86757, EUVD-2026-74934, CVE-2026-86758, EUVD-2026-74935, CVE-2026-86754, EUVD-2026-74931, CVE-2026-86774, EUVD-2026-74951, CVE-2026-86773, EUVD-2026-74950, CVE-2026-86772, EUVD-2026-74949, CVE-2026-86771, EUVD-2026-74948, CVE-2026-86770, EUVD-2026-74947, CVE-2026-86769, EUVD-2026-74946, CVE-2026-86752, EUVD-2026-74929, CVE-2026-86759, EUVD-2026-74936, CVE-2026-86756, EUVD-2026-74933, CVE-2026-86760, EUVD-2026-74937

  3. #3

    Referenz(en) aufgenommen: CVE-2026-86736, EUVD-2026-72872, CVE-2026-86735, EUVD-2026-72871, CVE-2026-86734, EUVD-2026-72870, CVE-2026-86733, EUVD-2026-72869, CVE-2026-86738, EUVD-2026-72874, CVE-2026-86737, EUVD-2026-72873

  4. #2

    Referenz(en) aufgenommen: CVE-2026-84206, EUVD-2026-69294

  5. #1

    Initiale Fassung

References