CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

EUVD-2026-74923

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

EUVD-2026-74922

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86745

Snipe-IT (IT asset management) master-branch builds after 8.6.3 are vulnerable to CSV Formula Injection in the Location-Scoping Export. The SettingsController::downloadLocationScopingReport endpoint (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call witho...

CVE-2026-86744

Snipe-IT (8.6.3 and earlier) is affected by a race condition in its asset checkout paths. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without a row lock or r...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

EUVD-2026-74921

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

EUVD-2026-74920

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-86743

Snipe-IT versions before 8.7.0 contain an authorization bypass in the asset acceptance report functionality. The root cause is a failure to properly scope asset acceptance report queries by company, allowing authenticated users with the reports.view permission to read pending acceptances across a...

CVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML tags pointing to local files or remote URLs, which the mail auto-embed library r...

EUVD-2026-74919

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...