1234 matches found
Snipe-IT has an Improper Privilege Management issue
Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...
CVE-2026-55515
creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:33+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg...
GHSA-575R-357H-FHCH Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...
EUVD-2026-42984
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...
EUVD-2026-42995
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...
GHSA-35CR-9HQQ-P2MG Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...
Snipe-IT has CSS Injection via `header_color` Setting
Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...
GHSA-W7QW-5WFV-GWX9 Snipe-IT has CSS Injection via `header_color` Setting
Impact Because default.blade.php is the base layout loaded on every authenticated page, all active user sessions are affected immediately upon the next page load after the payload is saved. An attacker who has compromised an admin account or who is a malicious insider can use this to silently...
EUVD-2026-43003
Snipe-IT has CSS Injection via headercolor Setting...
Snipe-IT has incorrect permission for legacy license checkin API
Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...
GHSA-8FRH-VHGH-64CF Snipe-IT has incorrect permission for legacy license checkin API
Impact The legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission. Because of this, a user who is allowed to assign licenses but not unassign them can still directly access the old checkin endpoint and reclaim a license seat th...
EUVD-2026-42998
Snipe-IT has incorrect permission for legacy license checkin API...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
GHSA-CRV3-J83J-F3R6 Snipe-IT has missing object-level authorization in Kits API
Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...
Snipe-IT has missing object-level authorization in Kits API
Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...
GHSA-53JC-27PC-X8R8 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/itemType/itemId/cancelbyadmin?/requestingUser? accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently...