CVE-2026-86774

Snipe-IT versions prior to 8.7.0 contain a broken access control vulnerability in the AssetModelPolicy class. The files() method cascades from the assets.files permission, allowing any authenticated user with that permission to upload and delete file attachments on Asset Model records—bypassing t...

EUVD-2026-74951

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86774 Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86774

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86774 Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission...

CVE-2026-86773

Snipe-IT through version 8.6.3 suffers from broken object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints, as well as the storeModel endpoint for Predefined Kits . The root cause is that the existing check authorizes only the parent Predefine...

CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86767 Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...

EUVD-2026-74941

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

EUVD-2026-74940

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Evan NR in WordPress Plugin Shirt Product Designer for WooCommerce versions 1.0.4...

WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by William Honnér in WordPress Plugin WP Fast Total Search versions = 1.82.284...

WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin BuddyForms versions = 2.9.0...

WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin Robokassa payment gateway for Woocommerce versions = 1.8.9...

CVE-2026-82848

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-18042

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-13146

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...