SB20260814125 - Multiple vulnerabilities in snipe-it

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260814125

SB20260814125 - Multiple vulnerabilities in snipe-it

Published: August 14, 2026 Updated: October 13, 2026

Security Bulletin ID SB20260814125
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 22% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2026-55703)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in MaintenancesController::show() when handling GET requests to /maintenances/{id}. A remote user can request a maintenance record URL directly to disclose sensitive information.

The issue is limited to maintenance records within the caller's company because route-model binding still enforces company scope, and maintenance IDs are sequential and visible in record URLs.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-55694)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the EULA file access routes when handling requests for user EULA metadata and stored EULA files. A remote user can query another user's EULA metadata to obtain the secret filename and then request the file through the vulnerable profile route to disclose sensitive information.

Exploitation requires chaining an information disclosure in the /api/v1/users/{target_id}/eulas endpoint with an insecure direct object reference in the /account/stored-eula-file/{filename} route.


3) Improper access control (CVE-ID: CVE-2026-85617)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete users outside their authorized scope.

The vulnerability exists due to improper access control in the bulk user delete functionality when handling bulk delete requests. A remote user can include unauthorized user IDs in a bulk delete payload to delete users outside their authorized scope.

The issue results in soft-deletion of targeted users and can affect users in other companies or higher-privileged users.


4) Improper access control (CVE-ID: CVE-2026-55643)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass tenant isolation to read, modify, and soft-delete out-of-scope user records.

The vulnerability exists due to improper access control in multiple API endpoints and bulk action web routes when handling company-scoped user operations. A remote user can access and manipulate users with company_id = null to bypass tenant isolation to read, modify, and soft-delete out-of-scope user records.

The issue affects floater mode and exposed data can include personally identifiable information, assigned licenses, and transferred assigned assets.


5) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass account deactivation and regain authenticated access at the account's original permission level.

The vulnerability exists due to improper authentication in GoogleAuthController::handleGoogleCallback when handling Google SSO callbacks without checking the local user's activated flag. A remote user can sign in with still-valid Google credentials associated with a deactivated local account to bypass account deactivation and regain authenticated access at the account's original permission level.

Exploitation requires the local username to match the Google identity's email address.


6) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof the recorded creator of a category.

The vulnerability exists due to improperly controlled mass assignment of the created_by attribute in CategoriesController::store and the Category model when processing API creation requests. A remote user can submit a request containing another user's identifier in created_by to spoof the recorded creator of a category.

Exploitation requires API authentication and create permission for categories. The Category model has no observer to record the actual creator separately.


7) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof the recorded creator of a company.

The vulnerability exists due to improperly controlled mass assignment of the created_by attribute in CompaniesController::store and the Company model when processing API creation requests. A remote user can submit a request containing another user's identifier in created_by to spoof the recorded creator of a company.

Exploitation requires API authentication and create permission for companies. The Company model has no observer to record the actual creator separately.


8) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof the recorded creator of a license in its model row.

The vulnerability exists due to improperly controlled mass assignment of the created_by attribute in LicensesController::store and the License model when processing API creation requests. A remote user can submit a request containing another user's identifier in created_by to spoof the recorded creator of a license in its model row.

Exploitation requires API authentication and create permission for licenses. LicenseObserver records the actual user's identifier in action_logs, preserving accurate attribution in that separate audit record.


9) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose LDAP service-account credentials and end-user passwords.

The vulnerability exists due to an unchecked return value from ldap_start_tls() in app/Models/Ldap.php::connectToLdap() when negotiating LDAP StartTLS. A remote attacker can respond to the StartTLS request with a protocol error and observe the subsequent plaintext bind traffic to disclose LDAP service-account credentials and end-user passwords.

Exploitation requires LDAP authentication to be enabled with ldap_enabled = 1 and ldap_tls = 1, and access to the network path between Snipe-IT and the LDAP server. Login behavior remains normal because the plaintext bind can succeed.


Remediation

Install update from vendor's website.

References