snipe/snipe-it Security Advisories for v8.6.0 (19)
-
[HIGH] Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
PKSA-9w68-kyxd-kgh7 CVE-2026-55516 GHSA-575r-357h-fhch
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
PKSA-mtr1-kyd4-dpz1 CVE-2026-55515 GHSA-35cr-9hqq-p2mg
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT has CSS Injection via `header_color` Setting
PKSA-78g8-kyjb-j6v1 CVE-2026-55481 GHSA-w7qw-5wfv-gwx9
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT has incorrect permission for legacy license checkin API
PKSA-j17x-hbvs-1cxn CVE-2026-55479 GHSA-8frh-vhgh-64cf
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT has missing object-level authorization in Kits API
PKSA-3nxv-xvdx-984d CVE-2026-55478 GHSA-crv3-j83j-f3r6
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT's import created_by can be overwritten
PKSA-spdd-pnpq-79f1 CVE-2026-55475 GHSA-5wx7-xq8j-v4qm
Affected version: <=8.6.0
Reported by:
GitHub -
[MEDIUM] Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
PKSA-wsms-bsnd-yhwp CVE-2026-55472 GHSA-8w8c-8mx9-52cw
Affected version: <=8.6.1
Reported by:
GitHub -
[LOW] Snipe-IT has a path traversal vulnerability via CSV import `image` field
PKSA-4bks-zvdb-53gs CVE-2026-55469 GHSA-xr9m-gphc-9p63
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT vulnerable to stored XSS via inline-served attachment
PKSA-3mmm-zfys-jjqm CVE-2026-55466 GHSA-jhph-5q74-pmfx
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT vulnerable to stored XSS via Markdown custom field
PKSA-6ddj-s9z1-gtxr CVE-2026-55464 GHSA-r52f-r9v5-66xr
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT has an authorization bypass on print inventory page
PKSA-2vjy-7jj7-vvq3 CVE-2026-55462 GHSA-fc33-6w3q-538h
Affected version: <=8.6.0
Reported by:
GitHub -
[MEDIUM] Snipe-IT has an Open Redirect After User Edit
PKSA-3b5d-jjsk-z4w4 CVE-2026-55461 GHSA-wg2f-x2c2-c4rp
Affected version: <=8.6.1
Reported by:
GitHub -
[HIGH] Snipe-IT has an authorization bypass on bulk editing users
PKSA-n99m-2gcm-8bc6 CVE-2026-55460 GHSA-vgx7-c78r-69w9
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT has CSV formula injection in Activity Report export
PKSA-cj32-qmb9-vwgy CVE-2026-55452 GHSA-whrx-mmgr-gpcf
Affected version: <=8.6.1
Reported by:
GitHub -
[MEDIUM] Snipe-IT: Stored DOM XSS via table selected-count IDs
PKSA-9ywr-ywdr-gcrt CVE-2026-61807 GHSA-c8qc-wf67-342w
Affected version: <8.6.2
Reported by:
GitHub -
[MEDIUM] Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
PKSA-2v9y-4jt3-bxpm CVE-2026-55703 GHSA-r9r3-g9fp-3q4q
Affected version: <8.6.3
Reported by:
GitHub -
[HIGH] Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
PKSA-9n96-zyz7-nxh9 CVE-2026-55694 GHSA-3hgv-jr5j-cg9x
Affected version: <8.6.3
Reported by:
GitHub -
[HIGH] Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
PKSA-g91f-rycz-yjcf CVE-2026-55643 GHSA-c6w2-j4wq-mvwg
Affected version: <8.6.3
Reported by:
GitHub -
[HIGH] Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
PKSA-2tsw-c1yg-xhyc CVE-2026-54329 GHSA-pwpj-p52h-q484
Affected version: <=8.6.1
Reported by:
GitHub