CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

PT-2026-89034

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/id'...

PT-2026-89028

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authorization failure exists in the 'POST /hardware/history' endpoint, which allows any authenticated user to reassign arbitrary assets and modify audit logs. By submitting a CSV file, an attacke...

CVE-2026-6469

A flaw was found in PostgreSQL where the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This grants the table owner unauthorized privileges to execute DROP STATISTICS and ALTER STATISTICS while locking out the legitimate owner...

CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. The code validated only that the target role existed and was project-scoped, but performed no project-level authorization check . A user holding only the narrow role:manageProjec...

CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

CVE-2026-77079: Authorization Bypass Through User-Controlled Key

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

PT-2026-80779

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...

PT-2026-78272

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

Incorrect Ownership Assignment

Overview Affected versions of this package are vulnerable to Incorrect Ownership Assignment in the ALTER TABLE ALTER TYPE process. An attacker can gain unauthorized ability to execute DROP STATISTICS and ALTER STATISTICS on affected objects by exploiting improper reassignment of ownership...

CVE-2026-16904

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-16904

CVE-2026-16904 (IBM i) affects IBM i 7.3–7.6. A remote authenticated attacker could execute arbitrary commands due to improper privilege management during monitor owner reassignment. CVSSv3.1 base score 8.1 (High): vectors include AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; privileges required: LOW; net...

EUVD-2026-57358

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-16904

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

CVE-2026-16904: Improper Privilege Management

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...

EUVD-2026-54514

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...