SB2026082531 - Multiple vulnerabilities in snipe-it

Description

This security bulletin contains information about 46 vulnerabilities.

1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify inventory assignment records and cause inconsistent downstream processing.

The vulnerability exists due to improper input validation in the API checkout endpoints when processing checkout requests that reference soft-deleted users, assets, or locations. A remote user can send a specially crafted checkout request to modify inventory assignment records and cause inconsistent downstream processing.

Exploitation requires the relevant checkout permission for the affected resource.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in LicensesController::getExportLicensesCsv() when handling requests to export license data as CSV. A remote user can request the bulk CSV export to disclose sensitive information.

The exposed data consists of license product keys in cleartext, subject only to the standard FMCS company scope.

3) Observable Response Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to observable response discrepancy in Api\\LicensesController::index() when processing product_key, filter, or search queries against license serial values. A remote user can submit crafted API queries to disclose sensitive information.

The response masks the product key value, but the total count and presence or absence of rows reveal whether a candidate key or substring matched.

4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to tamper with asset ownership records and inject fraudulent audit-log entries.

The vulnerability exists due to missing authorization in the legacy asset-history CSV importer (`POST /hardware/history`, `AssetsController::postImportHistory`) when processing a multipart POST request containing a `user_import_csv` file. A remote user can submit a crafted CSV file to tamper with asset ownership records and inject fraudulent audit-log entries.

In multi-company deployments, the issue can affect assets belonging to other companies and bypass normal checkout policy and company scoping.

5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to incorrect authorization in app/Http/Controllers/Users/UsersController::update() when handling a full valid PUT request to the single-user edit route. A remote user can submit a specially crafted request to deactivate admin or superuser accounts and cause a denial of service.

The issue is limited to the activated field. Username, email, password, and permissions cannot be modified through this path, and exploitation requires the users.edit permission on the target\'s company scope.

6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the location print endpoints and print template when handling requests to location print views. A remote user can request a printassigned or printallassigned endpoint for a location to disclose sensitive information.

Instances that grant location view permission but deny view permission for related users, assets, accessories, consumables, or components are particularly affected.

7) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to retain read and write API access after account deactivation.

The vulnerability exists due to insufficient session expiration in api middleware and personal access token handling when processing authenticated REST API requests for a deactivated account. A remote user can continue using an existing personal access token to retain read and write API access after account deactivation.

A deactivated account with user-management permissions can reactivate itself through the API using its unchanged token.

8) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Livewire importer at App\\Livewire\\Importer when loading Import records for the importer file list and preview. A remote user can select or enumerate other users\' Import records to disclose sensitive information.

User interaction is required to access the importer UI, and the disclosure is limited to preview data such as stored metadata, column headers, and the first CSV row. In multi-company deployments, the exposure can cross tenant boundaries.

9) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /api/v1/hardware//assigned/components endpoint when handling requests for assigned component details. A remote user can send a request to enumerate component IDs, names, quantities, and notes to disclose sensitive information.

Direct component API requests correctly enforce the required permission and return forbidden responses, but the affected endpoint checks only the parent asset permission before returning linked component data.

10) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify asset custody records and bypass checkout workflow restrictions.

The vulnerability exists due to improper enforcement of behavioral workflow in the PATCH /api/v1/hardware/{asset_id} asset update endpoint when processing assignment fields in asset update requests. A remote user can submit a specially crafted PATCH request with assigned_user, assigned_asset, or assigned_location fields to modify asset custody records and bypass checkout workflow restrictions.

The issue can be exploited by an authenticated account with asset view and edit permissions but without checkout or check-in permissions, and it can overwrite an existing assignment without an intervening check-in.

11) Race condition (CVE-ID: N/A)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt inventory availability records.

The vulnerability exists due to concurrent execution using shared resource with improper synchronisation in the POST /api/v1/consumables/{consumable_id}/checkout endpoint when processing concurrent checkout requests. A remote user can send concurrent checkout requests to corrupt inventory availability records.

Exploitation requires a valid target user ID and a consumable with at least one remaining unit.

12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information across company boundaries.

The vulnerability exists due to incorrect authorization in the /hardware/requested requested-assets listing endpoint when handling a GET request with FMCS enabled. A remote user can send an unmodified GET request to disclose sensitive information across company boundaries.

Only FMCS-enabled installations are vulnerable, and the endpoint may expose the requested asset name, the requester\'s display name and profile link, the location, and the expected check-in date from other companies\' pending requests.

13) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in custom_fields_form.blade.php when rendering encrypted custom-field values in asset workflow forms. A remote user can open a corresponding asset form to disclose sensitive information.

The issue affects listbox, textarea, markdown-textarea, and text-backed date and datetime picker field types. In multi-company deployments, disclosure is limited to assets within the caller\'s company scope.

14) Improper Ownership Management (CVE-ID: N/A)

CWE-ID: CWE-282 - Improper Ownership Management

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to alter audit-trail integrity.

The vulnerability exists due to improper ownership management in the API consumable checkout endpoint when processing checkout requests. A remote user can send a specially crafted API request to alter audit-trail integrity.

The issue misattributes the `created_by` field on `consumables_users` pivot rows to the checkout target rather than the authenticated API caller, while the separate `action_logs` stream records the correct actor.

15) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to take over another user\'s account.

The vulnerability exists due to improper handling of case sensitivity in the SAML login username lookup in app/Services/Saml.php when processing a signed SAML assertion and resolving the username against users.username using a collation-folded equality query. A remote user can supply a username that is an accent or case variant of a victim\'s username to take over another user\'s account.

The issue occurs on MySQL or MariaDB installations where the users.username column uses the default utf8mb4_unicode_ci collation, and the same lookup pattern also affected other federated login paths including LDAP, REMOTE_USER, and Google OAuth.

16) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to restore soft-deleted assets without delete permission.

The vulnerability exists due to incorrect authorization in BulkAssetsController::restore() when handling POST requests to /hardware/bulkrestore. A remote user can send a crafted POST request with asset ids to restore soft-deleted assets without delete permission.

The issue affects the bulk asset restore endpoint and requires the assets.edit permission but not the assets.delete permission.

17) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to server-side request forgery in CheckoutAcceptance::generateAcceptancePdf() when processing a crafted employee_num value in TCPDF writeHTML() during acceptance PDF generation. A remote user can inject an tag pointing to an arbitrary http(s) URL to perform server-side request forgery.

User interaction is required because the victim must sign an acceptance for an assigned asset to trigger the outbound request.

18) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script in a victim\'s browser.

The vulnerability exists due to improper neutralization of input during web page generation in DepartmentPresenter::formattedNameLink() when rendering department names on the /account/view-assets page for users without the departments.view permission. A remote user can store a malicious script payload in a department name to execute arbitrary script in a victim\'s browser.

User interaction is required, and the payload executes when a member of the affected department loads their \"My Assets\" page.

19) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and modify data associations.

The vulnerability exists due to incorrect authorization in PredefinedKitsController update and storeModel endpoints when handling requests to attach licenses, consumables, accessories, or asset models to predefined kits. A remote user can send a specially crafted request referencing an object they cannot directly read to disclose sensitive information and modify data associations.

The relation index leaks the attached object\'s name back to the caller, and no user interaction is required.

20) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to upload or delete file attachments on asset model records.

The vulnerability exists due to incorrect authorization in AssetModelPolicy file authorization and uploaded file controllers when handling file upload and delete requests for asset model attachments. A remote user can send crafted requests to asset model file endpoints to upload or delete shared model file attachments.

Under Full Multiple Company Support, asset models are not company-scoped, so the issue can affect model records across company boundaries.

21) Cross-site scripting (CVE-ID: CVE-2026-63498)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary JavaScript in another user\'s web session.

The vulnerability exists due to cross-site scripting in the uploaded-files API show() method when rendering uploaded XML documents inline through the API. A remote user can upload crafted XML and XSLT files and cause a victim to open the inline API file URL to execute arbitrary JavaScript in another user\'s web session.

User interaction is required, and exploitation requires file attachment access to a supported object.

22) Improper access control (CVE-ID: CVE-2026-63493)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass two-factor authentication and obtain a persistent API token with full API access as the victim user.

The vulnerability exists due to improper access control in the API token flow and API middleware when handling password-authenticated sessions that have not completed two-factor authentication. A remote user can log in with a known password, access the two-factor route, and create a personal access token to bypass two-factor authentication and obtain a persistent API token with full API access as the victim user.

If the victim account has administrative privileges, the resulting token can also access administrative API endpoints.

23) Cross-site scripting (CVE-ID: CVE-2026-62368)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script in a victim\'s session.

The vulnerability exists due to cross-site scripting in asset-list column headers when rendering a custom field name in the asset list. A remote privileged user can create a custom field with crafted HTML or JavaScript to execute arbitrary script in a victim\'s session.

User interaction is required to open an asset list page, and exploitation can lead to privilege escalation if a higher-privileged user\'s session is targeted.

24) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authorization and obtain admin-scoped API access.

The vulnerability exists due to incorrect authorization in Livewire components in app/Livewire/ when processing replayed signed component snapshots through POST /livewire/update. A remote user can replay a valid signed snapshot and invoke component public methods under their own session to bypass authorization and obtain admin-scoped API access.

User interaction is required for the primary escalation path, and exploitation requires a valid signed snapshot of a protected component.

25) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access internal services and disclose sensitive information via server-side request forgery.

The vulnerability exists due to improper restriction of rendered transition IPv6 addresses in ExternalUrl validation rule in app/Rules/ExternalUrl.php when validating webhook URLs or resolved AAAA records. A remote privileged user can supply a specially crafted webhook URL containing an IPv6 transition address or a hostname resolving to one to access internal services and disclose sensitive information via server-side request forgery.

Exploitation is possible on NAT64-, 6to4-, or Teredo-enabled hosts and can target cloud instance metadata endpoints such as 169.254.169.254.

26) Incorrect calculation (CVE-ID: N/A)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify asset request counters and misrepresent pending demand.

The vulnerability exists due to incorrect calculation in checkout-request endpoints when processing duplicate request submissions and cancel requests without an active checkout request. A remote user can send repeated crafted requests to modify asset request counters and misrepresent pending demand.

The issue affects both the API and sibling web checkout-request paths, and repeated calls can drive the counter below zero or inflate the admin queue.

27) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in app/Http/Controllers/Assets/AssetsController.php::getBarCode when handling GET /hardware/{asset}/barcode requests. A remote user can iterate asset IDs and retrieve barcode PNGs to disclose sensitive information.

The barcode encodes the asset tag, and the response behavior can reveal asset existence and deletion state, including cross-company assets under FMCS.

28) Improper Encoding or Escaping of Output (CVE-ID: N/A)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to compromise peer superuser accounts.

The vulnerability exists due to improper encoding or escaping of output in the Custom CSS field rendering in Setting::show_custom_css() and the global layout