Vulnerabilities

Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to its API middleware group and does not revoke a user's Passport personal access tokens when that user is deactivated (CWE-862). An attacker or former employee holding an existing API token for a deactivated account can therefore continue calling the REST API — reading and modifying assets, users, licenses, and other records — at the account's prior permission level until the token expires, even though web login is correctly blocked. If the deactivated account retains user-management permissions, it can even reactivate itself through the API, permanently undoing the deactivation control. All Snipe-IT deployments running a version before 8.7.0 in which deactivated users held issued API tokens are affected. There is no evidence of in-the-wild exploitation, no public proof-of-concept, and the issue is not in the CISA KEV catalog.

Do: Upgrade to Snipe-IT 8.7.0 or later. As an interim mitigation, manually revoke the Passport personal access tokens of any deactivated users (delete their oauth_access_tokens entries) and audit recently deactivated accounts for API activity, including unexpected self-reactivation or changes made at their former permission level.

Snipe-IT versions before 8.7.0 contain a CSS injection flaw (CWE-79) in the Custom CSS field, where sanitization HTML-encodes greater-than and double-quote characters but then reverses that encoding, allowing crafted CSS containing those characters to pass through unescaped. A superuser can plant a payload built from @import and url() references combined with attribute-selector rules; when other superusers load the application, the injected CSS silently sends their CSRF tokens to attacker-controlled servers. With a stolen CSRF token, the attacker can perform cross-site request forgery actions against the victim's session, achieving takeover of other superuser accounts. Any organization running Snipe-IT prior to 8.7.0 is affected, with risk concentrated in instances that have multiple superusers, one of which is malicious or compromised. Despite a critical 9.3 CVSS 4.0 score, exploitation is currently unknown: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes the Custom CSS sanitization. Until then, audit the Custom CSS field for unexpected @import, url(), or attribute-selector payloads, restrict superuser accounts to trusted administrators, and consider limiting outbound network access from the Snipe-IT server to block token exfiltration. Deployments with only a single superuser have little practical exposure unless that account itself is compromised.

Snipe-IT, a self-hosted open-source IT asset management platform, contains an authorization bypass (CWE-639) in its bulk user delete functionality in all versions prior to 8.6.3. An authenticated user with restricted, scope-limited permissions can submit a bulk delete request that includes user IDs outside their authorized scope, and the application soft-deletes them without validating that the target users belong to the attacker's permitted scope. This lets a low-privileged attacker modify or disable (soft-delete) accounts they should not be able to access, bypassing instance-level restrictions and potentially disrupting administrator or other users' accounts (CVSS 4.0: 8.7 High, network vector, low privileges, no user interaction). All Snipe-IT deployments running a version before 8.6.3 that use restricted user roles are affected. There is currently no public proof of concept, the flaw is not in the CISA KEV catalog, and EPSS is low (0.3%), indicating no known exploitation to date.

Do: Upgrade to Snipe-IT 8.6.3 or later, which enforces scope checks in bulk delete. Until patched, restrict bulk-delete capability to fully privileged roles and review audit logs for bulk user delete actions performed by restricted users; check for and restore any accounts soft-deleted or modified outside their assigned company/scope.

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.