CVE-2026-86770

Snipe-IT before 8.7.0 fails to enforce exact-case username matching during federated authentication, and its default utf8mb4_unicode_ci database collation treats usernames that differ only by letter case or accents as identical. An attacker who can create or control an account at the identity provider registers a username that is a case or accent variant of a victim's username, then authenticates via SAML, LDAP, or OAuth. The login is matched to the victim's Snipe-IT account, giving the attacker full takeover of that account and its privileges (asset management access and any actions that account can perform). All Snipe-IT deployments prior to 8.7.0 that use federated login paths are affected; deployments using only local password authentication are not exposed through this path. There is currently no CISA KEV listing, no public proof-of-concept, and no reports of in-the-wild exploitation.

What to do: Upgrade to Snipe-IT 8.7.0 or later. Interim mitigations: ensure identity provider usernames exactly match Snipe-IT usernames (same case and no accent variants), restrict who can create or self-register accounts on the IdP, and audit recent federated logins for accounts created or used under case/accent-variant usernames. The flaw only applies where SAML, LDAP, or OAuth login is enabled.