CGA-8F86-C77W-C3G7

Bulletin has no description...

CGA-4JCF-854W-3PX7

Bulletin has no description...

CGA-7HJ7-R385-QJG3

Bulletin has no description...

CGA-Q7XF-W3MX-VV8X

Bulletin has no description...

CGA-4VQH-CMCH-2F32

Bulletin has no description...

CVE-2026-86766

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

CGA-P5Q5-PHXV-2JV9

Bulletin has no description...

CGA-7XC5-2FRG-8Q2J

Bulletin has no description...

CVE-2026-86762

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86765

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86760

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CGA-527P-GWVM-842G

Bulletin has no description...

CGA-5378-38JH-WP9P

Bulletin has no description...

CGA-CJ57-2MWW-2JQ9

Bulletin has no description...

CVE-2026-86761

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users,...

CGA-3FQ6-FMGX-GM3X

Bulletin has no description...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CGA-5V9W-WW9Q-28C3

Bulletin has no description...

CGA-7MQ2-HF96-PPG3

Bulletin has no description...

CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...