Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

snipe-it — Vulnerabilities & Security Advisories 92

All 92 CVE vulnerabilities found in snipe-it, with AI-generated Chinese analysis, references, and POCs.

This page covers vulnerability aggregation for Snipe-IT, an open-source asset management application developed by Snipe-IT LLC. It collects data related to common weakness types such as cross-site scripting, SQL injection, and path traversal vulnerabilities affecting this specific software product. The information presented spans from the initial public release of the software through to the most recent security advisories issued by the vendor or discovered by the security community. By consulting this resource, users can effectively track the historical advisory pattern of the vendor to assess their remediation speed and transparency. Additionally, researchers can use this data to better understand the specific implementation flaws and weakness classes that frequently arise in asset management tools. Users may also look up the complete vulnerability history of Snipe-IT to evaluate the long-term security posture of the application. This aggregated view aids in risk assessment and helps administrators prioritize updates based on the severity and prevalence of known issues. The content is organized to facilitate a clear understanding of how vulnerabilities have evolved in this product line over time. It serves as a neutral reference point for security analysts, developers, and IT professionals seeking factual data without speculative commentary. All entries are derived from official security notices and verified third-party reports.

Vendor: snipe

CVE ID Title CVSS Severity Published
CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update CWE-863 7.7 High 2026-09-09
CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive CWE-460 6.1 Medium 2026-09-09
CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User CWE-863 5.4 Medium 2026-09-09
CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay CWE-269 6.4 Medium 2026-09-09
CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export CWE-1236 6.5 Medium 2026-09-09
CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout CWE-362 2.2 Low 2026-09-09
CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report CWE-639 5.0 Medium 2026-09-09
CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report CWE-1236 6.5 Medium 2026-09-09
CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CWE-73 8.5 High 2026-09-09
CVE-2026-86739 Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence CWE-252 3.1 Low 2026-09-09
CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains CWE-212 3.8 Low 2026-09-09
CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS CWE-79 8.7 High 2026-09-08
CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint CWE-862 4.3 Medium 2026-09-08
CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure CWE-682 4.3 Medium 2026-09-08
CVE-2026-86734 Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field CWE-400 6.5 Medium 2026-09-08
CVE-2026-86735 snipe-it before 8.7.0 SSRF via IPv6 transition address bypass CWE-918 5.0 Medium 2026-09-08
CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore CWE-78 7.2 High 2026-09-08
CVE-2026-85617 snipe-it before 8.6.3 Authorization Bypass via Bulk Delete CWE-639 8.8 High 2026-09-04
CVE-2026-85616 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance CWE-639 8.5 High 2026-09-04
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore CWE-863 4.3 Medium 2026-09-01
CVE-2026-55694 Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover CWE-639 7.1 High 2026-08-19
CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode CWE-863 7.6 High 2026-08-19
CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET CWE-862 4.3 Medium 2026-08-19
CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs CWE-79 6.3 Medium 2026-08-19
CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR) CWE-285 5.4 Medium 2026-08-19
CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update CWE-639 6.3 Medium 2026-08-19
CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation CWE-862 4.9 Medium 2026-08-19
CVE-2026-50550 Snipe-IT: 2FA reset privilege bypass CWE-863 5.8 Medium 2026-08-19
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` CWE-770 5.9 Medium 2026-08-19
CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import CWE-863 6.5 Medium 2026-08-19

All 92 known CVE vulnerabilities affecting snipe-it with full Chinese analysis, references, and POCs where available.