CVE-2026-86770— Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
Quick assessment
Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Snipe-IT 在 8.7.0 之前的版本在 SAML 认证过程中未能正确校验用户名的大小写敏感性，导致攻击者可以通过注册带有变音符号或大小写变体的 IDP（身份提供商）账户，以不同用户身份进行认证。攻击者可利用默认的 数据库排序规则，绕过用户名匹配机制，并通过 SAML、LDAP 和 OAuth 等联合登录路径实现账户接管。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86770
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| grokability | snipe-it | 8.6.3 ~ 8.7.0 | - |
|
II. Public POCs for CVE-2026-86770
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86770
请登录查看更多情报信息。
Other References for CVE-2026-86770 (2)
Same Patch Batch · grokability · 2026-09-09 · 36 CVEs total
| CVE-2026-86741 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA |
| CVE-2026-86751 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown |
| CVE-2026-86762 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware |
| CVE-2026-86750 | 7.7 HIGH | snipe-it before 8.7.0 Authorization Bypass via API User Create/Update |
| CVE-2026-86771 | 7.6 HIGH | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num |
| CVE-2026-86754 | 7.3 HIGH | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients |
| CVE-2026-86759 | 7.1 HIGH | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer |
| CVE-2026-86766 | 6.5 MEDIUM | Snipe-IT 8.6.3 Race Condition via Consumable Checkout |
| CVE-2026-86757 | 6.5 MEDIUM | Snipe-IT before 8.7.0 Information Disclosure via Custom Fields |
| CVE-2026-86764 | 6.5 MEDIUM | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86758 | 6.5 MEDIUM | Snipe-IT before 8.7.0 License Key Exposure via CSV Export |
| CVE-2026-86765 | 6.5 MEDIUM | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86742 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report |
| CVE-2026-86745 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export |
| CVE-2026-86746 | 6.4 MEDIUM | Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay |
| CVE-2026-86774 | 6.3 MEDIUM | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy |
| CVE-2026-86749 | 6.3 MEDIUM | snipe-it before 8.7.0 Data Loss via Failed Image Write |
| CVE-2026-86756 | 6.1 MEDIUM | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState |
| CVE-2026-86748 | 6.1 MEDIUM | Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive |
| CVE-2026-86768 | 5.4 MEDIUM | Snipe-IT before 8.7.0 Improper Input Validation via API Checkout |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: snipe-it
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86769
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumabl
Same vendor: grokability
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86769
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumabl
Same weakness: CWE-178
-
CVE-2026-82067
Improper Case Sensitivity Handling in MongoDB Server Configu -
CVE-2021-48006
PocketMine-MP before 4.0.3 Operator Privilege Escalation via -
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplet -
CVE-2026-73476
External Authentication - Moderately critical - Access bypas -
CVE-2026-84303
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header M
V. Comments for CVE-2026-86770
No comments yet