CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection in the ReportsController::postAssetAcceptanceReport process. An attacker can inject malicious formula content into free-text fields that appear in the acceptan...

Information Exposure

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Information Exposure via the CSV export and API index endpoints due to improper enforcement of authorization checks. An attacker can access sensitive license key information...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the POST /hardware/history process. An attacker can reassign assets and modify audit logs by submitting a crafted CSV file, potentially compromising...

CVE-2026-86763

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86759

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86758

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86745

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

EUVD-2026-74935

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86758

Snipe-IT versions prior to 8.7.0 contain an authorization bypass in the CSV export and API index endpoints. The application fails to properly enforce the viewKeys authorization gate, allowing any authenticated user with only the licenses.view permission to access product keys —a permission level ...

CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...