CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key after stripping only CR/LF characters, and LoginCon...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

CVE-2026-86754

Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

EUVD-2026-74931

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

EUVD-2026-74932

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (/oauth/personal-access-tokens*) with only the web and auth:web middleware, lacking the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any user with a valid we...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86753

snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

EUVD-2026-74930

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

EUVD-2026-74929

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

EUVD-2026-74928

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...