CVE-2026-86763

Snipe-IT versions 7.0.12 through 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer). The component checked only the broad import ability at mount time, while its files() and activeFile() methods queried the imports table with no owner or company scope...

CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762

Snipe-IT before 8.7.0 is vulnerable to an authentication bypass via its API middleware. The CheckUserIsActivated middleware is not applied to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke existing Passport personal access tokens . A deactivated account t...

EUVD-2026-74939

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

EUVD-2026-74932

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (/oauth/personal-access-tokens*) with only the web and auth:web middleware, lacking the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any user with a valid we...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86749

Snipe-IT versions up to 8.6.3 contain a data-loss flaw in ImageUploadRequest::handleImages() . The application does not check the return value of Storage::disk('public')->put() or Storage::delete() , so when a storage backend transiently fails (e.g., an S3 network error, filesystem permission ...

CVE-2026-86749 snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86749 snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

EUVD-2026-74926

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86746

Snipe-IT before 8.7.0 is affected by an authorization bypass in Livewire components . The root cause is that authorization checks are enforced only at the route level , not within component lifecycle methods, allowing attackers with a valid authenticated session to replay signed component snapsho...

CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...