Skip to contentSnipeitapp Snipe-it vulnerabilities
- grokability snipe-itsnipe-it before 8.6.3 Authorization Bypass via Bulk DeleteCVE-2026-856178.7 High
- grokability snipe-itSnipe-IT before 8.6.2 Authorization Bypass via Checkout-AcceptanceCVE-2026-856168.4 High
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via Bulk RestoreCVE-2026-842065.3 Medium
- grokability snipe-itSnipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File TakeoverCVE-2026-55694Fix available7.1 High
- grokability snipe-itSnipe-IT: Tenant Isolation Bypass in FMCS Floater ModeCVE-2026-55643Fix available7.6 High
- grokability snipe-itSnipe-IT: Maintenance Record Disclosure via Missing Authorization on GETCVE-2026-55703Fix available4.3 Medium
- grokability snipe-itSnipe-IT: Stored DOM XSS via table selected-count IDsCVE-2026-61807Fix available6.3 Medium
- grokability snipe-itSnipe-IT Checkout Request Cancellation IDORCVE-2026-195795.3 Medium
- grokability snipe-itSnipe-IT: CSS Injection via `header_color` SettingCVE-2026-55481Fix available6.2 Medium
- grokability snipe-itSnipe-IT: Import created_by can be overwrittenCVE-2026-55475Fix available5.7 Medium
- grokability snipe-itSnipe-IT: Path traversal vulnerability via CSV import `image` fieldCVE-2026-55469Fix available6.5 Medium
- grokability snipe-itSnipe-IT: Open Redirect After User EditCVE-2026-55461Fix available6.1 Medium
- grokability snipe-itSnipe-IT: Incorrect permission for legacy license checkin APICVE-2026-55479Fix available5.3 Medium
- grokability snipe-itSnipe-IT: CSV formula injection in Activity Report exportCVE-2026-55452Fix available4.8 Medium
- grokability snipe-itSnipe-IT: Stored XSS via inline-served attachmentCVE-2026-55466Fix available6.2 Medium
- grokability snipe-itSnipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpointCVE-2026-55515Fix available5.0 Medium
- grokability snipe-itSnipe-IT: Authorization bypass on print inventory pageCVE-2026-55462Fix available4.3 Medium
- grokability snipe-itSnipe-IT: Stored XSS via Markdown custom fieldCVE-2026-55464Fix available4.8 Medium
- grokability snipe-itSnipe-IT: Authorization bypass on bulk editing usersCVE-2026-55460Fix available7.1 High
- grokability snipe-itSnipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary ValidationCVE-2026-55472Fix available4.3 Medium
- grokability snipe-itSnipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin ParameterCVE-2026-55476Fix available5.3 Medium
- grokability snipe-itSnipe-IT: Missing object-level authorization in Kits APICVE-2026-55478Fix available5.3 Medium
- grokability snipe-itSnipe-IT: Improper Privilege ManagementCVE-2026-55843Fix available7.0 High
- grokability snipe-itSnipe-IT: Cross-company asset maintenance re-parenting via API updateCVE-2026-55516Fix available7.7 High
- grokability snipe-itSnipe-IT: Directory traversal in displaySigCVE-2026-55474Fix available7.1 High
- grokability snipe-itSnipe-IT: Cross-Tenant Accessory Injection in Snipe-IT APICVE-2026-54329Fix available8.5 High
- grokability snipe-itSnipe-IT's S3 signature image retrieval lacks authorization before temporary URLCVE-2026-55542Fix available1.3 Low
- grokability snipe-itSnipe-IT: Improper Authorization in File Deletion (IDOR)CVE-2026-55519Fix available5.4 Medium
- grokability snipe-itSnipe-IT: Privilege Escalation via Missing admin Permission Check in User CreationCVE-2026-55483Fix available4.9 Medium
- grokability snipe-itSnipe-IT: Multi-Tenancy Bypass via Bulk Asset UpdateCVE-2026-55482Fix available6.3 Medium
- grokability snipe-itSnipe-IT: 2FA reset privilege bypassCVE-2026-50550Fix available5.8 Medium
- grokability snipe-itSnipe-IT: User Account Escalation via CSV ImportCVE-2026-49976Fix available6.5 Medium
- grokability snipe-itSnipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`CVE-2026-49870Fix available5.9 Medium
- grokability snipe-itSnipe-IT's selectlist visibility is too permissiveCVE-2026-48492Fix available4.9 Medium
- grokability snipe-itSnipe-IT Vulnerable to Privilege Escalation for self via API Permissions AssignmentCVE-2026-48493Fix available5.5 Medium
- grokability snipe-itSnipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing usersCVE-2026-48507Fix available7.1 High
- grokability snipe-itSnipe-IT: Open redirect vulnerabilityCVE-2026-44833Fix available5.9 Medium
- grokability snipe-itSnipe-IT: Privilege Escalation via API Permissions AssignmentCVE-2026-44832Fix available8.7 High
- grokability snipe-itSnipe-IT: XSS vulnerability in component notesCVE-2026-44831Fix available4.8 Medium
- snipeitapp snipe-itSnipe-IT has insecure permissions in file uploadsCVE-2026-37709Fix available9.8 Critical
- snipeitapp snipe-itAn improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0...CVE-2026-385336.5 Medium
- grokability, inc. snipe-itSnipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege EscalationCVE-2025-15602Public exploitFix available8.7 High
- snipeitapp snipe-itSnipe-IT allows stored XSS via the Locations "Country" fieldCVE-2025-65622Fix available5.4 Medium
- snipeitapp snipe-itSnipe-IT is vulnerable to stored cross-site scriptingCVE-2025-65621Fix available5.4 Medium
- snipeitapp snipe-itSnipe-IT has Cross-site Scripting vulnerability in CSV import workflowCVE-2025-64027Public exploitDisputed6.1 Medium
- snipeitapp snipe-itSnipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an...CVE-2025-636019.9 Critical
- grokability, inc. snipe-itSnipe-IT allows unsafe deserializationCVE-2025-59713Fix available6.8 Medium
- grokability, inc. snipe-itSnipe-IT allows XSSCVE-2025-59712Public exploitFix available6.4 Medium
- grokability, inc. snipe-itGrokability Snipe-IT has incorrect authorization for accessing asset informationCVE-2025-47226Public exploitFix available5.0 Medium
- snipeitapp snipe-itAn issue in Snipe-IT v.7.0.13 build 15514 allows a remote attacker to escalate privileges via the...CVE-2024-510948.0 High
- Show moreLoading…