Improper Handling of Case Sensitivity in snipe-it - CVE-2026-86770
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote user to take over another user's account.
The vulnerability exists due to improper handling of case sensitivity in the SAML login username lookup in app/Services/Saml.php when processing a signed SAML assertion and resolving the username against users.username using a collation-folded equality query. A remote user can supply a username that is an accent or case variant of a victim's username to take over another user's account.
The issue occurs on MySQL or MariaDB installations where the users.username column uses the default utf8mb4_unicode_ci collation, and the same lookup pattern also affected other federated login paths including LDAP, REMOTE_USER, and Google OAuth.