| Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target… CVE-2026-88894 | Severity medium |
| Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from… CVE-2026-86774 | Severity medium |
| Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and… CVE-2026-86773 | Severity medium |
| Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where… CVE-2026-86772 | Severity medium |
| Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with… CVE-2026-86771 | Severity high |
| Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as… CVE-2026-86770 | Severity high |
| Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records… CVE-2026-86769 | Severity medium |
| Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout… CVE-2026-86768 | Severity medium |
| Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company… CVE-2026-86767 | Severity medium |
| Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST… CVE-2026-86766 | Severity medium |
| Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint… CVE-2026-86765 | Severity medium |
| Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET… CVE-2026-86764 | Severity medium |
| Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted… CVE-2026-86763 | Severity low |
| Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and… CVE-2026-86762 | Severity high |
| snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model… CVE-2026-86761 | Severity medium |
| Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in… CVE-2026-86760 | Severity medium |
| Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary… CVE-2026-86759 | Severity high |
| Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing… CVE-2026-86758 | Severity medium |
| Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea… CVE-2026-86757 | Severity medium |
| Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST… CVE-2026-86756 | Severity medium |
| Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE… CVE-2026-86755 | Severity medium |
| Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register… CVE-2026-86754 | Severity high |
| snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId}… CVE-2026-86753 | Severity medium |
| snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering… CVE-2026-86752 | Severity medium |
| Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary… CVE-2026-86751 | Severity critical |
| Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST… CVE-2026-86750 | Severity high |
| Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in… CVE-2026-86749 | Severity medium |
| Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers… CVE-2026-86748 | Severity medium |
| Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST… CVE-2026-86747 | Severity medium |
| Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route… CVE-2026-86746 | Severity medium |
| Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged… CVE-2026-86745 | Severity medium |
| Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths… CVE-2026-86744 | Severity low |
| Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users… CVE-2026-86743 | Severity medium |
| Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export… CVE-2026-86742 | Severity medium |
| Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers… CVE-2026-86741 | Severity high |
| Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and… CVE-2026-86740 | Severity low |
| Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF… CVE-2026-86739 | Severity medium |
| snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated… CVE-2026-86737 | Severity medium |
| snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to… CVE-2026-86736 | Severity medium |
| Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing… CVE-2026-86734 | Severity medium |
| snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users… CVE-2026-85617 | Severity high |
| Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple… CVE-2026-85616 | Severity high |
| Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without… CVE-2026-84206 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET… CVE-2026-63498 | Severity high |
| Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission… CVE-2026-63493 | Severity high |
| Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in… CVE-2026-62368 | Severity high |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component… CVE-2026-61807 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read… CVE-2026-55703 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain… CVE-2026-55694 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose… CVE-2026-55643 | Severity high |
| Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete… CVE-2026-55519 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin… CVE-2026-55483 | Severity high |
| Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use… CVE-2026-55482 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor… CVE-2026-50550 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite… CVE-2026-49976 | Severity medium |
| Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter… CVE-2026-49870 | Severity medium |
Zetlyn