| Package | Affected versions | Patched versions |
|---|---|---|
| snipe-it | < 8.7.0 | 8.7.0 |
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free