| CVE-2026-55460 | ÉLEVÉE7.1 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-a | 10/07/2026 |
| CVE-2026-54329 | ÉLEVÉE7.7 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple | 10/07/2026 |
| CVE-2026-48492 | MOYENNE6.5 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API t | 08/07/2026 |
| CVE-2026-55542 | MOYENNE4.3 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize() | 08/07/2026 |
| CVE-2026-48493 | MOYENNE5.5 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in ve | 23/06/2026 |
| CVE-2026-48507 | ÉLEVÉE7.1 | Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, | 08/06/2026 |
| CVE-2026-44833 | ÉLEVÉE7.1 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1. | 26/05/2026 |
| CVE-2026-44832 | ÉLEVÉE8.8 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, al | 26/05/2026 |
| CVE-2026-44831 | MOYENNE5.4 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1. | 26/05/2026 |
| CVE-2026-37709 | CRITIQUE9.8 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component | 07/05/2026 |
| CVE-2026-38533 | MOYENNE6.5 | An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request. | 14/04/2026 |
| CVE-2025-15602 | ÉLEVÉE8.8 | Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By c | 06/03/2026 |
| CVE-2025-65622 | MOYENNE5.4 | Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session. | 01/12/2025 |
| CVE-2025-65621 | MOYENNE5.4 | Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation. | 01/12/2025 |
| CVE-2025-64027 | MOYENNE6.1 | Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/upda | 20/11/2025 |
| CVE-2025-63601 | CRITIQUE9.9 | Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands. | 05/11/2025 |
| CVE-2025-59713 | ÉLEVÉE8.1 | Snipe-IT before 8.1.18 allows unsafe deserialization. | 19/09/2025 |
| CVE-2025-59712 | MOYENNE5.4 | Snipe-IT before 8.1.18 allows XSS. | 19/09/2025 |
| CVE-2025-47226 | FAIBLE3.3 | Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. | 02/05/2025 |
| CVE-2024-51094 | ÉLEVÉE8.0 | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the | 12/11/2024 |