CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. Authenticated users holding the assets.view permission can retrieve pending asset requests from all companies without parameter manipulation,...

CVE-2026-86766 Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

EUVD-2026-74941

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86765

Snipe-IT versions prior to 8.7.0 are affected by an authorization bypass in the asset update endpoint (PATCH /api/v1/hardware/{id} ). The root cause is a failure to enforce checkout authorization when assignment parameters (assigned_user, assigned_asset, or assigned_location) are submitted. An au...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86764

Snipe-IT through 8.6.4 (fixed in 8.7.0 ) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components . The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is a...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86753

snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

EUVD-2026-74925

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

Vulnerability handling in Ivanti Endpoint Manager Mobile

Ivanti has identified a vulnerability in Ivanti Endpoint Manager Mobile. This vulnerability relates to the lack of authentication control in versions of Ivanti Endpoint Manager Mobile older than 12.10.0.0, 12.9.0.2, and 12.8.0.4. As a result, authenticated users may be able to elevate their...

CVE-2026-87821

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...