SB20260814123 - Multiple vulnerabilities in snipe-it

Description

This security bulletin contains information about 15 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-54329)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to inject persistent accessory records into another company\'s inventory data.

The vulnerability exists due to improper access control in the Snipe-IT Accessories API create path when handling accessory creation requests with a foreign company_id value. A remote user can submit a crafted API request to inject persistent accessory records into another company\'s inventory data.

Only instances with Full Multiple Companies Support (FMCS) enabled are vulnerable.

2) Improper access control (CVE-ID: CVE-2026-55479)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to reclaim a license seat assigned to another user or asset.

The vulnerability exists due to improper access control in the legacy single-seat license checkin API endpoint when handling direct requests to the old checkin endpoint. A remote user can send a request to the legacy checkin endpoint to reclaim a license seat assigned to another user or asset.

The vulnerable flow authorizes the action with the checkout permission instead of the checkin permission.

3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-55478)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify kit contents by associating an unauthorized license.

The vulnerability exists due to improper access control in the POST /api/v1/kits/{kit_id}/licenses endpoint when handling requests that add a license to a predefined kit. A remote user can send a specially crafted request referencing a license they should not be allowed to access to modify kit contents by associating an unauthorized license.

The issue only checks whether the caller can edit kits and does not perform object-level authorization on the referenced license.

4) Improper access control (CVE-ID: CVE-2026-55472)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the API endpoint for creating locations when handling location creation requests with a parent location from a different company. A remote user can submit a crafted API request to disclose sensitive information.

Only instances with Full Multiple Companies Support and scope_locations_fmcs enabled are vulnerable. The equivalent Web flow correctly rejects the same relationship.

5) Path traversal (CVE-ID: CVE-2026-55469)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to delete arbitrary files on the server filesystem.

The vulnerability exists due to path traversal in the CSV import image field when processing imported asset records and triggering image deletion. A remote attacker can inject a path traversal string into the image field via CSV import to delete arbitrary files on the server filesystem.

Exploitation requires the import and assets.update permissions.

6) Cross-site scripting (CVE-ID: CVE-2026-55466)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script in the victim\'s browser in the context of the application.

The vulnerability exists due to improper neutralization of script in uploaded XHTML content in the attachment upload and inline file serving functionality when uploading a crafted XML/XHTML attachment and accessing it with inline serving enabled. A remote user can upload a crafted attachment containing script and have it rendered inline as same-origin active content to execute arbitrary script in the victim\'s browser in the context of the application.

The issue occurs because XML/XHTML content can bypass the SVG sanitization path and is served with Content-Disposition: inline.

7) Cross-site scripting (CVE-ID: CVE-2026-55464)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in a victim\'s browser session.

The vulnerability exists due to improper neutralization of input during web page generation in markdown-textarea custom fields when rendering Markdown hyperlinks containing javascript: URIs. A remote user can inject a malicious link into a custom field to execute arbitrary JavaScript in a victim\'s browser session.

User interaction is required because the victim must open the asset detail page and click the crafted link.

8) Improper Authorization (CVE-ID: CVE-2026-55460)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete another non-admin user.

The vulnerability exists due to improper access control in the POST /users/bulksave endpoint when handling a bulk user edit request with delete_user=1. A remote user can send a specially crafted POST request to delete another non-admin user.

The issue occurs because the destructive sink authorizes update rather than delete, while the UI and confirmation path require delete permission.

9) Open redirect (CVE-ID: CVE-2026-55461)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an external site.

The vulnerability exists due to improper control of redirect destinations in the user edit flow when processing a user edit request with an attacker-controlled Referer header and redirect_option=back. A remote attacker can cause a user to open the edit page and submit a normal edit action to redirect users to an external site.

User interaction is required, and exploitation depends on a logged-in user with permission to edit a user record performing the edit flow.

10) Cross-site scripting (CVE-ID: CVE-2026-61807)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in the victim\'s browser.

The vulnerability exists due to cross-site scripting in the table component when rendering stored manufacturer or supplier names into selected-count identifiers. A remote user can inject a crafted manufacturer or supplier name to execute arbitrary JavaScript in the victim\'s browser.

User interaction is required to view an affected manufacturer or supplier detail page.

11) Missing Authorization (CVE-ID: CVE-2026-55516)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify asset maintenance records across company boundaries.

The vulnerability exists due to improper access control in the PATCH /api/v1/maintenances/{maintenance_id} and PUT /api/v1/maintenances/{maintenance_id} endpoints when handling maintenance record updates with a user-supplied asset_id. A remote user can send a crafted API update request to modify asset maintenance records across company boundaries.

Only multi-company deployments with Full Multiple Company Support are vulnerable, and the issue requires access to a maintenance record attached to an asset in the user\'s own company.

12) Improper access control (CVE-ID: CVE-2026-55515)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete pending checkout acceptance records across company boundaries.

The vulnerability exists due to improper access control in the unaccepted assets report delete endpoint when handling deletion requests by global acceptance ID. A remote user can send a specially crafted request to delete pending checkout acceptance records across company boundaries.

Exploitation requires a valid authenticated web session, the reports.view permission, and knowledge or guessability of a pending checkout_acceptances.id. The issue affects multi-company mode.

13) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-55452)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute attacker-controlled formulas in spreadsheet software.

The vulnerability exists due to improper neutralization of formula elements in CSV export in ReportsController::postActivityReport() when exporting activity report data containing a user-supplied User-Agent value. A remote user can supply a formula-like User-Agent header and perform a logged action to execute attacker-controlled formulas in spreadsheet software.

User interaction is required to export the Activity Report and open it in spreadsheet software.

14) Cross-site scripting (CVE-ID: CVE-2026-55481)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements in css output in the `header_color` setting in `default.blade.php` when rendering user-supplied branding color values inside a CSS `