1531 matches found
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...
Snipe-IT has CSS Injection via `header_color` Setting
Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...
GHSA-W7QW-5WFV-GWX9 Snipe-IT has CSS Injection via `header_color` Setting
Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...
EUVD-2026-43003
Snipe-IT has CSS Injection via headercolor Setting...
EUVD-2026-42998
Snipe-IT has incorrect permission for legacy license checkin API...
GHSA-8FRH-VHGH-64CF Snipe-IT has incorrect permission for legacy license checkin API
Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...
Snipe-IT has incorrect permission for legacy license checkin API
Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...
GHSA-CRV3-J83J-F3R6 Snipe-IT has missing object-level authorization in Kits API
Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...
Snipe-IT has missing object-level authorization in Kits API
Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
EUVD-2026-42989
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...
GHSA-53JC-27PC-X8R8 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...
GHSA-5WX7-XQ8J-V4QM Snipe-IT's import created_by can be overwritten
Impact The createdby of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key...
EUVD-2026-43001
Snipe-IT's import createdby can be overwritten...
Snipe-IT's import created_by can be overwritten
Impact The createdby of an import file can be arbitrarily overwritten via the Importer API endpoint by a user with CSV import capabilities who also has a valid API key...
Snipe-IT vulnerable to directory traversal in displaySig
Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...
EUVD-2026-42983
Snipe-IT vulnerable to directory traversal in displaySig...
GHSA-C6F4-WJ38-M3G3 Snipe-IT vulnerable to directory traversal in displaySig
Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...