SB20260814125 - Multiple vulnerabilities in snipe-it

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260814125

SB20260814125 - Multiple vulnerabilities in snipe-it

Published: August 14, 2026

Security Bulletin ID SB20260814125
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2026-55703)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in MaintenancesController::show() when handling GET requests to /maintenances/{id}. A remote user can request a maintenance record URL directly to disclose sensitive information.

The issue is limited to maintenance records within the caller\'s company because route-model binding still enforces company scope, and maintenance IDs are sequential and visible in record URLs.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-55694)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the EULA file access routes when handling requests for user EULA metadata and stored EULA files. A remote user can query another user\'s EULA metadata to obtain the secret filename and then request the file through the vulnerable profile route to disclose sensitive information.

Exploitation requires chaining an information disclosure in the /api/v1/users/{target_id}/eulas endpoint with an insecure direct object reference in the /account/stored-eula-file/{filename} route.


3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete users outside their authorized scope.

The vulnerability exists due to improper access control in the bulk user delete functionality when handling bulk delete requests. A remote user can include unauthorized user IDs in a bulk delete payload to delete users outside their authorized scope.

The issue results in soft-deletion of targeted users and can affect users in other companies or higher-privileged users.


4) Improper access control (CVE-ID: CVE-2026-55643)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass tenant isolation to read, modify, and soft-delete out-of-scope user records.

The vulnerability exists due to improper access control in multiple API endpoints and bulk action web routes when handling company-scoped user operations. A remote user can access and manipulate users with company_id = null to bypass tenant isolation to read, modify, and soft-delete out-of-scope user records.

The issue affects floater mode and exposed data can include personally identifiable information, assigned licenses, and transferred assigned assets.


Remediation

Install update from vendor's website.

References