PT-2026-89039

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Insufficient validation of username case sensitivity during SAML authentication allows attackers to authenticate as other users. By registering Identity Provider IdP accounts using case or accent...

PT-2026-89034

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/id'...

PT-2026-89008

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description In the AccountAcceptanceController::store function, the software fails to verify the return value of Storage::put when saving signature PNGs and generated acceptance PDFs. On filesystem drivers that...

PT-2026-89035

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumable id/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transactio...

CVE-2026-86770: Improper Handling of Case Sensitivity

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

PT-2026-89024

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 4.2.0 through 8.6.3 Description Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE '/oauth/personal-access-tokens' are exposed using only 'web' and 'auth:web' middleware. This bypasses the...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

PT-2026-89030

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users,...

PT-2026-89036

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86767: Exposure of Sensitive Information to an Unauthorized Actor

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

CVE-2026-86735

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

CVE-2026-86737

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86736

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86734

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

CVE-2026-86733

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

Server-side Request Forgery (SSRF)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ExternalUrl validation process. An attacker can access internal services or cloud metadata endpoints by configuring webhook URLs with...

Incorrect Calculation

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Calculation via the checkout request process. An attacker can manipulate the assets.requestscounter by repeatedly submitting duplicate checkout requests or calling...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the GET /hardware/asset/barcode endpoint. An attacker can access barcodes and enumerate asset tags across tenants, including soft-deleted and...

Denial of Service (DoS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Denial of Service DoS via the note field in the POST /account/accept/acceptance endpoint. An attacker can exhaust server resources by submitting excessively large input,...