# snipe/snipe-it (Packagist) vulnerabilities 81 known vulnerabilities (3 critical, 18 high, 54 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/snipe/snipe-it ## Advisories (81) ### [CVE-2026-62368](https://cve.now/CVE-2026-62368): Snipe-IT: Stored XSS via Custom Field name in asset-list column headers - Severity: High 8.1 - Published: Sep 24, 2026 - Affected: fixed in 8.7.0. ### [CVE-2026-63493](https://cve.now/CVE-2026-63493): Snipe-IT: 2FA bypass via the API token flow - Severity: High 8.6 - Published: Sep 24, 2026 - Affected: fixed in 8.7.0. ### [CVE-2026-63498](https://cve.now/CVE-2026-63498): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API - Severity: High 8.7 - Published: Sep 24, 2026 - Affected: fixed in 8.7.0. ### [CVE-2026-55694](https://cve.now/CVE-2026-55694): Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover - Severity: High 7.1 - Published: Aug 19, 2026 - Affected: fixed in 8.6.3. ### [CVE-2026-55643](https://cve.now/CVE-2026-55643): Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode - Severity: High 7.6 - Published: Aug 19, 2026 - Affected: fixed in 8.6.3. ### [CVE-2026-55703](https://cve.now/CVE-2026-55703): Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET - Severity: Medium 4.3 - Published: Aug 19, 2026 - Affected: fixed in 8.6.3. ### [CVE-2026-61807](https://cve.now/CVE-2026-61807): Snipe-IT: Stored DOM XSS via table selected-count IDs - Severity: Medium 6.3 - Published: Aug 19, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55519](https://cve.now/CVE-2026-55519): Snipe-IT: Improper Authorization in File Deletion (IDOR) - Severity: Medium 5.4 - Published: Aug 19, 2026 - Affected: fixed in 8.4.1. ### [CVE-2026-55482](https://cve.now/CVE-2026-55482): Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update - Severity: Medium 6.3 - Published: Aug 19, 2026 - Affected: fixed in 8.4.2. ### [CVE-2026-55483](https://cve.now/CVE-2026-55483): Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation - Severity: Medium 4.9 - Published: Aug 19, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-50550](https://cve.now/CVE-2026-50550): Snipe-IT: 2FA reset privilege bypass - Severity: Medium 5.8 - Published: Aug 19, 2026 - Affected: fixed in 8.5.0. ### [CVE-2026-49870](https://cve.now/CVE-2026-49870): Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on \`POST /two-factor\` - Severity: Medium 5.9 - Published: Aug 19, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-49976](https://cve.now/CVE-2026-49976): Snipe-IT: User Account Escalation via CSV Import - Severity: Medium 6.5 - Published: Aug 19, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-55481](https://cve.now/CVE-2026-55481): Snipe-IT: CSS Injection via \`header\_color\` Setting - Severity: Medium 6.2 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55475](https://cve.now/CVE-2026-55475): Snipe-IT: Import created\_by can be overwritten - Severity: Medium 5.7 - Published: Jul 10, 2026 - Affected: fixed in 8.6.1. ### [CVE-2026-55469](https://cve.now/CVE-2026-55469): Snipe-IT: Path traversal vulnerability via CSV import \`image\` field - Severity: Medium 6.5 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55461](https://cve.now/CVE-2026-55461): Snipe-IT: Open Redirect After User Edit - Severity: Medium 6.1 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55479](https://cve.now/CVE-2026-55479): Snipe-IT: Incorrect permission for legacy license checkin API - Severity: Medium 5.3 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55452](https://cve.now/CVE-2026-55452): Snipe-IT: CSV formula injection in Activity Report export - Severity: Medium 4.8 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55466](https://cve.now/CVE-2026-55466): Snipe-IT: Stored XSS via inline-served attachment - Severity: Medium 6.2 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55515](https://cve.now/CVE-2026-55515): Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint - Severity: Medium 5.0 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55462](https://cve.now/CVE-2026-55462): Snipe-IT: Authorization bypass on print inventory page - Severity: Medium 4.3 - Published: Jul 10, 2026 - Affected: fixed in 8.6.1. ### [CVE-2026-55464](https://cve.now/CVE-2026-55464): Snipe-IT: Stored XSS via Markdown custom field - Severity: Medium 4.8 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55460](https://cve.now/CVE-2026-55460): Snipe-IT: Authorization bypass on bulk editing users - Severity: High 7.1 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55472](https://cve.now/CVE-2026-55472): Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation - Severity: Medium 4.3 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55476](https://cve.now/CVE-2026-55476): Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel\_by\_admin Parameter - Severity: Medium 5.3 - Published: Jul 10, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-55478](https://cve.now/CVE-2026-55478): Snipe-IT: Missing object-level authorization in Kits API - Severity: Medium 5.3 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55843](https://cve.now/CVE-2026-55843): Snipe-IT: Improper Privilege Management - Severity: High 7.0 - Published: Jul 10, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-55516](https://cve.now/CVE-2026-55516): Snipe-IT: Cross-company asset maintenance re-parenting via API update - Severity: High 7.7 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-55474](https://cve.now/CVE-2026-55474): Snipe-IT: Directory traversal in displaySig - Severity: High 7.1 - Published: Jul 10, 2026 - Affected: fixed in 8.5.0. ### [CVE-2026-54329](https://cve.now/CVE-2026-54329): Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API - Severity: High 8.5 - Published: Jul 10, 2026 - Affected: fixed in 8.6.2. ### [CVE-2026-48492](https://cve.now/CVE-2026-48492): Snipe-IT's selectlist visibility is too permissive - Severity: Medium 4.9 - Published: Jul 8, 2026 - Affected: fixed in 8.5.1. ### [CVE-2026-55542](https://cve.now/CVE-2026-55542): Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL - Severity: Low 1.3 - Published: Jul 8, 2026 - Affected: fixed in 8.5.1. ### [CVE-2026-48493](https://cve.now/CVE-2026-48493): Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment - Severity: Medium 5.5 - Published: Jun 23, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-48507](https://cve.now/CVE-2026-48507): Snipe-IT: Bulk editing users allowed \`ldap\_import\` and \`activated\_in\` bulk editing users - Severity: High 7.1 - Published: Jun 8, 2026 - Affected: fixed in 8.6.0. ### [CVE-2026-44833](https://cve.now/CVE-2026-44833): Snipe-IT: Open redirect vulnerability - Severity: Medium 5.9 - Published: May 26, 2026 - Affected: fixed in 8.4.1. ### [CVE-2026-44832](https://cve.now/CVE-2026-44832): Snipe-IT: Privilege Escalation via API Permissions Assignment - Severity: High 8.7 - Published: May 26, 2026 - Affected: fixed in 8.4.1. ### [CVE-2026-44831](https://cve.now/CVE-2026-44831): Snipe-IT: XSS vulnerability in component notes - Severity: Medium 4.8 - Published: May 26, 2026 - Affected: fixed in 8.4.1. ### [CVE-2026-37709](https://cve.now/CVE-2026-37709): Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote… - Severity: Critical 9.8 - Published: May 7, 2026 - Affected: fixed in 8.4.1. ### [CVE-2025-15602](https://cve.now/CVE-2025-15602): Snipe-IT \< 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation - Severity: High 8.7 - Published: Mar 6, 2026 - Affected: fixed in 8.3.7. ### [CVE-2025-65622](https://cve.now/CVE-2025-65622): Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject… - Severity: Medium 5.4 - Published: Dec 1, 2025 - Affected: fixed in 8.3.4. ### [CVE-2025-65621](https://cve.now/CVE-2025-65621): Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an… - Severity: Medium 5.4 - Published: Dec 1, 2025 - Affected: fixed in 8.3.4. ### [CVE-2025-64027](https://cve.now/CVE-2025-64027): Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. - Severity: Medium 6.1 - Published: Nov 20, 2025 - Affected: through 8.3.4. ### [CVE-2025-59713](https://cve.now/CVE-2025-59713): Snipe-IT before 8.1.18 allows unsafe deserialization. - Severity: Medium 6.8 - Published: Sep 19, 2025 - Affected: fixed in 8.1.18. ### [CVE-2025-59712](https://cve.now/CVE-2025-59712): Snipe-IT before 8.1.18 allows XSS. - Severity: Medium 6.4 - Published: Sep 19, 2025 - Affected: fixed in 8.1.18. ### [CVE-2025-47226](https://cve.now/CVE-2025-47226): Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. - Severity: Medium 5.0 - Published: May 2, 2025 - Affected: fixed in 8.1.0. ### [CVE-2024-51093](https://cve.now/CVE-2024-51093): Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing… - Severity: High 8.7 - Published: Nov 12, 2024 - Affected: through 7.0.13. ### [CVE-2024-48987](https://cve.now/CVE-2024-48987): Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP\_KEY. - Severity: Medium 6.6 - Published: Oct 11, 2024 - Affected: fixed in 7.0.10. ### [CVE-2024-5685](https://cve.now/CVE-2024-5685): Broken Function Level Authorization (BFLA) in snipe/snipe-it - Severity: High 7.6 - Published: Jun 14, 2024 - Affected: fixed in 6.4.2. ### [CVE-2023-5511](https://cve.now/CVE-2023-5511): Cross-Site Request Forgery (CSRF) in snipe/snipe-it - Severity: Medium 6.3 - Published: Oct 11, 2023 - Affected: fixed in 6.2.3. ### [CVE-2023-5452](https://cve.now/CVE-2023-5452): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: Medium 5.5 - Published: Oct 6, 2023 - Affected: fixed in 6.2.2. ### [CVE-2022-44381](https://cve.now/CVE-2022-44381): Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request. - Severity: Medium 5.3 - Published: Dec 25, 2022 - Affected: through 6.0.14. ### [CVE-2022-44380](https://cve.now/CVE-2022-44380): Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets. - Severity: Medium 5.4 - Published: Dec 25, 2022 - Affected: fixed in 6.0.14. ### [CVE-2022-3173](https://cve.now/CVE-2022-3173): Improper Authentication in snipe/snipe-it - Severity: Medium 4.3 - Published: Sep 17, 2022 - Affected: fixed in 6.0.10. ### [CVE-2022-3035](https://cve.now/CVE-2022-3035): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: Medium 5.9 - Published: Aug 29, 2022 - Affected: fixed in 6.0.11. ### [CVE-2022-2997](https://cve.now/CVE-2022-2997): Session Fixation in snipe/snipe-it - Severity: Medium 4.6 - Published: Aug 25, 2022 - Affected: fixed in 6.0.10. ### [CVE-2022-32061](https://cve.now/CVE-2022-32061): An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to… - Severity: Unrated - Published: Jul 7, 2022 - Affected: through 6.0.2. ### [CVE-2022-32060](https://cve.now/CVE-2022-32060): An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary… - Severity: Unrated - Published: Jul 7, 2022 - Affected: through 6.0.2. ### [CVE-2022-23064](https://cve.now/CVE-2022-23064): Snipe-IT - Host Header Injection - Severity: High 8.8 - Published: May 2, 2022 - Affected: from 3.0-alpha, fixed in 5.3.8. ### [CVE-2022-1511](https://cve.now/CVE-2022-1511): Missing Authorization in snipe/snipe-it - Severity: Medium 6.5 - Published: Apr 28, 2022 - Affected: fixed in 5.4.4. ### [CVE-2022-1445](https://cve.now/CVE-2022-1445): Stored Cross Site Scripting vulnerability in the checked\_out\_to parameter in snipe/snipe-it - Severity: Critical 9.0 - Published: Apr 24, 2022 - Affected: fixed in 5.4.3. ### [CVE-2022-1380](https://cve.now/CVE-2022-1380): Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it - Severity: Critical 9.1 - Published: Apr 16, 2022 - Affected: fixed in 5.4.3. ### [CVE-2022-1155](https://cve.now/CVE-2022-1155): Old sessions are not blocked by the login enable function. in snipe/snipe-it - Severity: High 7.4 - Published: Mar 30, 2022 - Affected: from 6.0.0-RC-1, fixed in 6.0.0-RC-6; fixed in 5.4.2. ### [CVE-2022-0622](https://cve.now/CVE-2022-0622): Generation of Error Message Containing Sensitive Information in snipe/snipe-it - Severity: Medium 5.3 - Published: Feb 17, 2022 - Affected: fixed in 5.3.11. ### [CVE-2022-0611](https://cve.now/CVE-2022-0611): Missing Authorization in snipe/snipe-it - Severity: Medium 6.3 - Published: Feb 15, 2022 - Affected: fixed in 5.3.11. ### [CVE-2022-0579](https://cve.now/CVE-2022-0579): Missing Authorization in snipe/snipe-it - Severity: Medium 6.5 - Published: Feb 14, 2022 - Affected: fixed in 5.3.9. ### [CVE-2022-0569](https://cve.now/CVE-2022-0569): Observable Discrepancy in snipe/snipe-it - Severity: Medium 5.3 - Published: Feb 12, 2022 - Affected: fixed in 5.3.10. ### [CVE-2022-0178](https://cve.now/CVE-2022-0178): Missing Authorization in snipe/snipe-it - Severity: Medium 6.3 - Published: Jan 13, 2022 - Affected: fixed in 5.3.8. ### [CVE-2022-0179](https://cve.now/CVE-2022-0179): Missing Authorization in snipe/snipe-it - Severity: Medium 6.3 - Published: Jan 12, 2022 - Affected: fixed in 5.3.7. ### [CVE-2021-4130](https://cve.now/CVE-2021-4130): Cross-Site Request Forgery (CSRF) in snipe/snipe-it - Severity: Medium 4.3 - Published: Dec 18, 2021 - Affected: fixed in 5.3.6. ### [CVE-2021-4108](https://cve.now/CVE-2021-4108): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: Medium 6.4 - Published: Dec 14, 2021 - Affected: fixed in 5.3.5. ### [CVE-2021-4089](https://cve.now/CVE-2021-4089): Improper Access Control in snipe/snipe-it - Severity: Medium 4.3 - Published: Dec 10, 2021 - Affected: fixed in 5.3.4. ### [CVE-2021-4075](https://cve.now/CVE-2021-4075): Server-Side Request Forgery (SSRF) in snipe/snipe-it - Severity: Low 2.7 - Published: Dec 6, 2021 - Affected: fixed in 6.0.0-GM. ### [CVE-2021-4018](https://cve.now/CVE-2021-4018): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: Medium 6.3 - Published: Dec 1, 2021 - Affected: fixed in 5.3.3. ### [CVE-2021-3961](https://cve.now/CVE-2021-3961): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: High 8.0 - Published: Nov 19, 2021 - Affected: fixed in 5.3.2. ### [CVE-2021-3931](https://cve.now/CVE-2021-3931): Cross-Site Request Forgery (CSRF) in snipe/snipe-it - Severity: Medium 4.3 - Published: Nov 13, 2021 - Affected: through 5.3.1. ### [CVE-2021-3938](https://cve.now/CVE-2021-3938): Cross-site Scripting (XSS) - Generic in snipe/snipe-it - Severity: Low 3.9 - Published: Nov 13, 2021 - Affected: fixed in 5.4.0. ### [CVE-2021-3879](https://cve.now/CVE-2021-3879): Cross-site Scripting (XSS) - Stored in snipe/snipe-it - Severity: Medium 6.8 - Published: Oct 19, 2021 - Affected: fixed in 5.3.0. ### [CVE-2021-3863](https://cve.now/CVE-2021-3863): Cross-site Scripting (XSS) - Generic in snipe/snipe-it - Severity: Medium 5.5 - Published: Oct 19, 2021 - Affected: fixed in 5.3.0. ### [CVE-2021-3858](https://cve.now/CVE-2021-3858): Cross-Site Request Forgery (CSRF) in snipe/snipe-it - Severity: Medium 4.3 - Published: Oct 19, 2021 - Affected: fixed in 5.3.0. ### [CVE-2019-10118](https://cve.now/CVE-2019-10118): Snipe-IT before 4.6.14 has XSS, as demonstrated by log\_meta values and the user's last name in the API. - Severity: Unrated - Published: Mar 27, 2019 - Affected: fixed in 4.6.14. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/snipe/snipe-it Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.