7 matches found
CVE-2026-86734
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
CVE-2026-86734
Snipe-IT versions before 8.7.1 are affected by a denial-of-service vulnerability in the POST /account/accept/{acceptance} endpoint. The root cause is the absence of length validation on the note field , allowing authenticated users to submit arbitrarily large values that trigger synchronous Commo...
CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
EUVD-2026-72870
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
PT-2026-87131
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...