895 matches found
CVE-2026-85617 snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions...
CVE-2026-85617
snipe-it versions before 8.6.3 contain an authorization bypass in the bulk delete functionality. Restricted users can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions, allowing them to soft-delete users outside their authorized scope or modify/disable ac...
CVE-2026-85616 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...
EUVD-2026-71035
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...
CVE-2026-85616
Snipe-IT versions before 8.6.2 contain an authorization bypass in checkout-acceptance report actions when Full Multiple Company Support is enabled. An authenticated user with the reports.view permission can exploit a null check on the legacy users.company_id column to enumerate sequential accepta...
CVE-2026-85616 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...
CVE-2025-64027
Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...
CVE-2026-84206
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
CVE-2026-84206
Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
EUVD-2026-42985
Snipe-IT has an Improper Privilege Management issue...
EUVD-2026-42984
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...
EUVD-2026-42995
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...
EUVD-2026-43003
Snipe-IT has CSS Injection via headercolor Setting...
EUVD-2026-42998
Snipe-IT has incorrect permission for legacy license checkin API...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
EUVD-2026-42989
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...